Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2024 17:40
Static task
static1
Behavioral task
behavioral1
Sample
Photoshop.exe
Resource
win10v2004-20240226-en
General
-
Target
Photoshop.exe
-
Size
3.0MB
-
MD5
a8048bd6fc7d336d7f6e0fd6800da673
-
SHA1
f28db14f2884ac1db0ce53a7ec7bee572541d902
-
SHA256
d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d
-
SHA512
570d1ac52dcb8f6c67983a4af99fece9f47e03beba83b9b2c95ce544f5b5f40c8c7e46019f5e106b258de2affee91988053dbab9e777e1c115d3803513eea066
-
SSDEEP
49152:zR5PaMqlX9BK+ndEBk6/HOg7wFXW3zrFlvmh+JJRV8EeCrXy7295sAZub1R:zR59qtaBk0HOXXWHbbbrNub
Malware Config
Signatures
-
Detect Poverty Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/216-63-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer behavioral1/memory/216-70-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer behavioral1/memory/216-71-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer behavioral1/memory/216-72-0x0000000000400000-0x000000000040A000-memory.dmp family_povertystealer -
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Photoshop.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation Photoshop.exe -
Executes dropped EXE 7 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exenmYIeCI7gcMH.exepid process 3740 7z.exe 1500 7z.exe 3176 7z.exe 4968 7z.exe 5088 7z.exe 1452 7z.exe 3576 nmYIeCI7gcMH.exe -
Loads dropped DLL 6 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exepid process 3740 7z.exe 1500 7z.exe 3176 7z.exe 4968 7z.exe 5088 7z.exe 1452 7z.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nmYIeCI7gcMH.exedescription pid process target process PID 3576 set thread context of 216 3576 nmYIeCI7gcMH.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exedescription pid process Token: SeRestorePrivilege 3740 7z.exe Token: 35 3740 7z.exe Token: SeSecurityPrivilege 3740 7z.exe Token: SeSecurityPrivilege 3740 7z.exe Token: SeRestorePrivilege 1500 7z.exe Token: 35 1500 7z.exe Token: SeSecurityPrivilege 1500 7z.exe Token: SeSecurityPrivilege 1500 7z.exe Token: SeRestorePrivilege 3176 7z.exe Token: 35 3176 7z.exe Token: SeSecurityPrivilege 3176 7z.exe Token: SeSecurityPrivilege 3176 7z.exe Token: SeRestorePrivilege 4968 7z.exe Token: 35 4968 7z.exe Token: SeSecurityPrivilege 4968 7z.exe Token: SeSecurityPrivilege 4968 7z.exe Token: SeRestorePrivilege 5088 7z.exe Token: 35 5088 7z.exe Token: SeSecurityPrivilege 5088 7z.exe Token: SeSecurityPrivilege 5088 7z.exe Token: SeRestorePrivilege 1452 7z.exe Token: 35 1452 7z.exe Token: SeSecurityPrivilege 1452 7z.exe Token: SeSecurityPrivilege 1452 7z.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Photoshop.execmd.exenmYIeCI7gcMH.exedescription pid process target process PID 4564 wrote to memory of 4464 4564 Photoshop.exe cmd.exe PID 4564 wrote to memory of 4464 4564 Photoshop.exe cmd.exe PID 4464 wrote to memory of 3432 4464 cmd.exe mode.com PID 4464 wrote to memory of 3432 4464 cmd.exe mode.com PID 4464 wrote to memory of 3740 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 3740 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 1500 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 1500 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 3176 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 3176 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 4968 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 4968 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 5088 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 5088 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 1452 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 1452 4464 cmd.exe 7z.exe PID 4464 wrote to memory of 4580 4464 cmd.exe attrib.exe PID 4464 wrote to memory of 4580 4464 cmd.exe attrib.exe PID 4464 wrote to memory of 3576 4464 cmd.exe nmYIeCI7gcMH.exe PID 4464 wrote to memory of 3576 4464 cmd.exe nmYIeCI7gcMH.exe PID 4464 wrote to memory of 3576 4464 cmd.exe nmYIeCI7gcMH.exe PID 3576 wrote to memory of 216 3576 nmYIeCI7gcMH.exe RegSvcs.exe PID 3576 wrote to memory of 216 3576 nmYIeCI7gcMH.exe RegSvcs.exe PID 3576 wrote to memory of 216 3576 nmYIeCI7gcMH.exe RegSvcs.exe PID 3576 wrote to memory of 216 3576 nmYIeCI7gcMH.exe RegSvcs.exe PID 3576 wrote to memory of 216 3576 nmYIeCI7gcMH.exe RegSvcs.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\system32\mode.commode 65,103⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p125762329330388294023250819845 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1452 -
C:\Windows\system32\attrib.exeattrib +H "nmYIeCI7gcMH.exe"3⤵
- Views/modifies file attributes
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe"nmYIeCI7gcMH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
1.3MB
MD5aad3ef70ef5b94a35d947e3610897dda
SHA1c79356fa52ab359e2b5fb66881d406e1941832d6
SHA256dd1ae4f1c0f588dd5fd3bba19ed784c0cd5b95ff4e9dd976bb815cb842840a25
SHA512e5c42f2302e4b079dc63fa38310663b5fd43520d97bd82eb7aa1dd5e98aa1474dd1d5cf47ef22a8dd95e0ca28ff12de24582d62cdb903132a809b069e26a19b4
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
Filesize
2.2MB
MD547e8ed572da00474326b4cee8f85b005
SHA194bceabdc880c41d73d6c984a9d61c31dd29ce91
SHA256abd52eb132c8c23669233a656f036a0e07692efd398894b724b61b66a75564af
SHA51231da04b57f0ef1b3363a3fa4855ca576d9159d374de0d2d9defb5524e67fed740441dcc2245a246daecab6260a419c02a32770ee9be53a2ddbede9dd4848d624
-
Filesize
509KB
MD55f79b89dbaf23387caa818b0da7b8ea2
SHA13c38d94819331fd551c07048841cfe6ecbf29e18
SHA2567abc58d9dd3dee48f88629c8dcaf12e72a337f8bf1dbce59d464ab6ed698b726
SHA512a6381f3b0d3184ab098e9a40ca65dd1cec76cb7e0cfe13a5c2d188e4c8e6d077286c70a366ad6ffc7e7f68faa6240a730b7034fcaa00d1c1f0922e42c1edb8fc
-
Filesize
509KB
MD5763cb011f068f184a672e254d3ce3c39
SHA159eb148e6ad321cac5396e6a58c1528f7932befb
SHA256d25782f4a9573c40747458b6916e9332b34a349b3011ec85dd5d11a583a87105
SHA512530b8c0ad90b53f38cd56ffaf3766f33167c9922e55f8485ca87019275730c94dd6a84a1d9578163c45bae2743cf6981041f9ccc97ceb822f8d607f94a0c1d28
-
Filesize
509KB
MD5210ee7f34c0ff268d33d598a49eb889a
SHA1876dea438f3f365513159630a12a2192fecd8b7f
SHA2569d8ee7edf36676633d624774cb194a45ef8ae286cb5e9591d46c20be57a9282f
SHA512383bb66f996b858d4ef23eed2264c4f890d47aca7b3da88587e3bb6454183f8d35e44411b08eecafe3fbb0638610cd872d1d00402dd8ff0b660102a44b53bcb1
-
Filesize
509KB
MD54ab6b1ed8f26df37c531a80147982511
SHA125d59710197c30eee836096dfcce139ba84f978a
SHA25633f73488015443cc05fa02d1c0723921502de5cac3206cf9fc433472a2afb162
SHA512a582e4cd93baf45b48aad086ffc5edab4ec899cbd029e9e740e93cf34a2aff492f14c92ed2efc0339fc4eed979311600007fca3075abda28232d9d351dd49e24
-
Filesize
2.1MB
MD59e57c6bb6dfb456cd9907844b7afafbd
SHA1daee76439ed4cd77192dc5c2d52b187f18e5ba99
SHA256729dbb0bd855dc1c1cf59366f49e29cb2b6e0d1279270924d2b131d7df749eab
SHA5123a99dae0a7c4ac47c5143dd6ada9a485cf115d3d9b172c3ba6d0847d6848e41defccd3a4eaf1b44c3ae46820c2164127b4e1ceaa5e07a8028e9b38f823a5960b
-
Filesize
619KB
MD553c6cf5bf9ce4922b3dc9bf9cc2374a2
SHA1b9a0d229a47fadaaa0898d32dce3aac279ac8569
SHA2562bb1a0a95249e3bcca1fdfc740bc91df10dc9c8cd834707a0b5a31883eb6867e
SHA512d323cfdfc3db5c5ce70ba572c0c657def11c3b36703a029977f5c5ddfdb278dfd1eea8950686d7a566dcd550aa0c854ceb035e6e67fcb377a8fc50dc4e0cd64c
-
Filesize
2.1MB
MD5afaebf70e6daf7bf2e07cd11f93ee4a1
SHA14e8b08b3e50f860955bd00d16fc1653c07b7c608
SHA2564a9d76fb9d77efaf81616e750b928ba3955599acafb2c0fec0d7ce412db0f47b
SHA5124db3a63f03f8816b85fdb905e2a2f08967f9f3735206f08f2cae8b8cd561e8563d2f92c188d32b94fdb6d472e07c5f41f54e26673f8a81449454225220ba397f
-
Filesize
491B
MD512b875e85a885c81bc04161e9df9151a
SHA17d9e32a575e487611abb182b4d89b1ab4f4e7a06
SHA25697e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5
SHA5123ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca