Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 01:09

General

  • Target

    e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060.exe

  • Size

    5.3MB

  • MD5

    0b01ec2c4b4faac5d7591c9b17d75d2d

  • SHA1

    a28a8431348d751709887d1293c80237782ab6b6

  • SHA256

    e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060

  • SHA512

    b1e8ce594be3b14968899c3be2c8bf8e583645beb3e3ec383821fcac0b8c8bbd4ff72c32bd11fed4194fd2e0b00cc53652d16fbfec516655ec8a0472ea93b17e

  • SSDEEP

    98304:PKMBJC+aOomVZs3/H+ub898uncF7IsMZJ7ANoQbz5MYverP6JU+B59yO4SO:Ph++zg3/Hbb8GunsmJgMijJUnO

Malware Config

Signatures

  • Detect Poverty Stealer Payload 9 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060.exe
    "C:\Users\Admin\AppData\Local\Temp\e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060.exe
      "C:\Users\Admin\AppData\Local\Temp\e2342e90d6baeda675e92025124c05266e4b99f251d967ff6a49ac65fa385060.exe"
      2⤵
        PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1728
        2⤵
        • Program crash
        PID:2056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4316 -ip 4316
      1⤵
        PID:1604

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe

        Filesize

        5.2MB

        MD5

        2646f45cbc43c5d529beec419223b392

        SHA1

        c9993aec66a45015ad22bfa1dc5a452088153d4c

        SHA256

        990104b6e90012b0d6dc9223143ae6e8850dec37c4b4cd9a89a8e3420e8a074f

        SHA512

        082d23d11332df267686499162d0efc76d7e01b25b7cc65aa87e151ff1a8bd109f936a534cd41b47dc96796f5947bd08787285bf450ab5beeb4741a52fb84a39

      • memory/2432-4-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-11-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-25-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-23-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-7-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-8-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-13-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-10-0x00000000032E0000-0x00000000032E1000-memory.dmp

        Filesize

        4KB

      • memory/2432-9-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/2432-12-0x0000000000400000-0x0000000000411000-memory.dmp

        Filesize

        68KB

      • memory/4316-2-0x00000000060D0000-0x0000000006674000-memory.dmp

        Filesize

        5.6MB

      • memory/4316-1-0x0000000000CD0000-0x000000000122A000-memory.dmp

        Filesize

        5.4MB

      • memory/4316-0-0x00000000744A0000-0x0000000074C50000-memory.dmp

        Filesize

        7.7MB

      • memory/4316-24-0x00000000744A0000-0x0000000074C50000-memory.dmp

        Filesize

        7.7MB

      • memory/4316-3-0x0000000005BF0000-0x0000000005C00000-memory.dmp

        Filesize

        64KB