poullight | c319696be10991321cffb0983531cb2b705a02b3a9354615e81db2d25d6302cb | Triage

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 16:43

Sharing

Report Analysis Logs

General

Target

065d9f4598e496874cd07d746b84b742.exe
Size

213KB
MD5

065d9f4598e496874cd07d746b84b742
SHA1

30a6f3a74b179608884ea7729ac0eab942d8dab6
SHA256

c319696be10991321cffb0983531cb2b705a02b3a9354615e81db2d25d6302cb
SHA512

e5a9429693e99eda3992dbba11c29dc80139499fa25524f4d306a9ac935c4479550ded7dfbd8500f9846e08bbe8b998523d5449ffd43573789f9e7a3ab3b58f0
SSDEEP

6144:vOmaqXgF5kSsv0wEIGiX821xz++wFvT+3MB7n:vpQjI04GiM21xz++Gt

Score

10^/10

poullight stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-0-0x0000000001030000-0x000000000106C000-memory.dmp	family_poullight
behavioral1/memory/2044-2-0x000000001B120000-0x000000001B1A0000-memory.dmp	family_poullight

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

065d9f4598e496874cd07d746b84b742.exe

pid process

2044 065d9f4598e496874cd07d746b84b742.exe
2044 065d9f4598e496874cd07d746b84b742.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

065d9f4598e496874cd07d746b84b742.exe

description pid process

Token: SeDebugPrivilege 2044 065d9f4598e496874cd07d746b84b742.exe

C:\Users\Admin\AppData\Local\Temp\065d9f4598e496874cd07d746b84b742.exe
"C:\Users\Admin\AppData\Local\Temp\065d9f4598e496874cd07d746b84b742.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-0-0x0000000001030000-0x000000000106C000-memory.dmp

Filesize
240KB

Download
memory/2044-1-0x000007FEF50D0000-0x000007FEF5ABC000-memory.dmp

Filesize
9.9MB

Download
memory/2044-2-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2044-7-0x000007FEF50D0000-0x000007FEF5ABC000-memory.dmp

Filesize
9.9MB

Download