Overview

overview

10

Static

static

10

87e5df4b2d...b8.exe

windows7-x64

10

87e5df4b2d...b8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 23:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    87e5df4b2d1ad17687a506394018aeb8.exe

  • Size

    100KB

  • MD5

    87e5df4b2d1ad17687a506394018aeb8

  • SHA1

    bfd775b8fc73d85f4127eaa4c3fb91123c5c78ff

  • SHA256

    bb5f523d4b4d9a8bfb0f0e89eff3559d228451476467b7b193e7686031398d3d

  • SHA512

    b6c8d4f334d3dcee4b6380b332beb12574c35ac355211e2454dd1e91899d8de578804e1293239a5a5ca5d723b42ddf5455803dd292447f874fdde137934e65fa

  • SSDEEP

    1536:GJv5McKmdnrc4TXN1x1vZD8ql6GrUZ5Bx5M9D7wOHUN4ZKNJH:GJeunoMXNf6+E5B/MuO0Ogt

Score
10/10
poullightspywarestealertrojan

Malware Config

Signatures

  • Poullight

    Poullight is an information stealer first seen in March 2020.

    trojanstealerpoullight
  • Poullight Stealer payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87e5df4b2d1ad17687a506394018aeb8.exe
    "C:\Users\Admin\AppData\Local\Temp\87e5df4b2d1ad17687a506394018aeb8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\mra4zn2qchlsmovnc8w1synb2grr2jz
    Filesize

    92KB

    MD5

    c00f3970108a8af891b5768c37ef0b63

    SHA1

    cf5e378a5236a9a015fa5617a303f9a5a296e645

    SHA256

    d1edb25dac788ec78d570f905d9c81651b4229228272b3ebc64d20b3ca8c6d43

    SHA512

    7542d99357fab4e243caad174e1f1eb172c334ede37af2e32f49bb30fece84599eb28bea005eccd920d5903a85dbe4bf56a55f8d87f29eaab6187a72d15be93b

    Download Submit
  • memory/5116-0-0x000002B8AB460000-0x000002B8AB480000-memory.dmp
    Filesize

    128KB

    Download
  • memory/5116-1-0x00007FFCEBE20000-0x00007FFCEC8E1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/5116-2-0x000002B8C58C0000-0x000002B8C58D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/5116-4-0x000002B8C5880000-0x000002B8C588A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/5116-31-0x000002B8C6BD0000-0x000002B8C6D92000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/5116-34-0x000002B8C72D0000-0x000002B8C77F8000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/5116-51-0x000002B8C5D80000-0x000002B8C5D92000-memory.dmp
    Filesize

    72KB

    Download
  • memory/5116-84-0x000002B8C59A0000-0x000002B8C5A48000-memory.dmp
    Filesize

    672KB

    Download
  • memory/5116-85-0x00007FFCEBE20000-0x00007FFCEC8E1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/5116-87-0x000002B8C58C0000-0x000002B8C58D0000-memory.dmp
    Filesize

    64KB

    Download