Analysis
-
max time kernel
214s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2023 10:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20231023-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
loader.exe
-
Size
92KB
-
MD5
ddd479eae63055960aea274cc64dcddf
-
SHA1
25b872831839ebdeff28c65f12857921087e1352
-
SHA256
b9b3faad6d063a6b63ef22080e78efa4e037e73107fea3883c8f191a435873ed
-
SHA512
10181dfe0fcc5a2dcec775b8f803cbd141151343aec633f662870f81bb996a19ae9e8c1aee093fe2f869197bbbc2138825e69960aaf0e09512df759a010dd103
-
SSDEEP
1536:u5qS7K3+OYV75P7T2Bfk6VbubwK6ZiyLXxgPSfn2pEqY8Gi4G:up1ABKbf6IyLXHfn2b4G
Score
10/10
Malware Config
Signatures
-
Detect Poverty Stealer Payload 5 IoCs
resource yara_rule behavioral2/memory/4160-1-0x00000000001C0000-0x00000000001CA000-memory.dmp family_povertystealer behavioral2/memory/4160-7-0x00000000001C0000-0x00000000001CA000-memory.dmp family_povertystealer behavioral2/memory/4160-6-0x00000000001C0000-0x00000000001CA000-memory.dmp family_povertystealer behavioral2/memory/4160-12-0x0000000000400000-0x000000000041A000-memory.dmp family_povertystealer behavioral2/memory/4160-11-0x00000000001C0000-0x00000000001CA000-memory.dmp family_povertystealer -
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4828 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4828 taskmgr.exe Token: SeSystemProfilePrivilege 4828 taskmgr.exe Token: SeCreateGlobalPrivilege 4828 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe 4828 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵PID:4160
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4828