Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 17:53
Static task
static1
Behavioral task
behavioral1
Sample
Photoshop.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Photoshop.exe
Resource
win10v2004-20240226-en
General
-
Target
Photoshop.exe
-
Size
3.0MB
-
MD5
a8048bd6fc7d336d7f6e0fd6800da673
-
SHA1
f28db14f2884ac1db0ce53a7ec7bee572541d902
-
SHA256
d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d
-
SHA512
570d1ac52dcb8f6c67983a4af99fece9f47e03beba83b9b2c95ce544f5b5f40c8c7e46019f5e106b258de2affee91988053dbab9e777e1c115d3803513eea066
-
SSDEEP
49152:zR5PaMqlX9BK+ndEBk6/HOg7wFXW3zrFlvmh+JJRV8EeCrXy7295sAZub1R:zR59qtaBk0HOXXWHbbbrNub
Malware Config
Signatures
-
Detect Poverty Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2268-86-0x0000000000090000-0x000000000009A000-memory.dmp family_povertystealer behavioral1/memory/2268-94-0x0000000000090000-0x000000000009A000-memory.dmp family_povertystealer behavioral1/memory/2268-96-0x0000000000090000-0x000000000009A000-memory.dmp family_povertystealer behavioral1/memory/2268-95-0x0000000000090000-0x000000000009A000-memory.dmp family_povertystealer -
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Executes dropped EXE 7 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exenmYIeCI7gcMH.exepid process 2680 7z.exe 2576 7z.exe 2476 7z.exe 2196 7z.exe 2440 7z.exe 2908 7z.exe 1996 nmYIeCI7gcMH.exe -
Loads dropped DLL 12 IoCs
Processes:
cmd.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exepid process 2548 cmd.exe 2680 7z.exe 2548 cmd.exe 2576 7z.exe 2548 cmd.exe 2476 7z.exe 2548 cmd.exe 2196 7z.exe 2548 cmd.exe 2440 7z.exe 2548 cmd.exe 2908 7z.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nmYIeCI7gcMH.exedescription pid process target process PID 1996 set thread context of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
nmYIeCI7gcMH.exepid process 1996 nmYIeCI7gcMH.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exedescription pid process Token: SeRestorePrivilege 2680 7z.exe Token: 35 2680 7z.exe Token: SeSecurityPrivilege 2680 7z.exe Token: SeSecurityPrivilege 2680 7z.exe Token: SeRestorePrivilege 2576 7z.exe Token: 35 2576 7z.exe Token: SeSecurityPrivilege 2576 7z.exe Token: SeSecurityPrivilege 2576 7z.exe Token: SeRestorePrivilege 2476 7z.exe Token: 35 2476 7z.exe Token: SeSecurityPrivilege 2476 7z.exe Token: SeSecurityPrivilege 2476 7z.exe Token: SeRestorePrivilege 2196 7z.exe Token: 35 2196 7z.exe Token: SeSecurityPrivilege 2196 7z.exe Token: SeSecurityPrivilege 2196 7z.exe Token: SeRestorePrivilege 2440 7z.exe Token: 35 2440 7z.exe Token: SeSecurityPrivilege 2440 7z.exe Token: SeSecurityPrivilege 2440 7z.exe Token: SeRestorePrivilege 2908 7z.exe Token: 35 2908 7z.exe Token: SeSecurityPrivilege 2908 7z.exe Token: SeSecurityPrivilege 2908 7z.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
Photoshop.execmd.exenmYIeCI7gcMH.exedescription pid process target process PID 2184 wrote to memory of 2548 2184 Photoshop.exe cmd.exe PID 2184 wrote to memory of 2548 2184 Photoshop.exe cmd.exe PID 2184 wrote to memory of 2548 2184 Photoshop.exe cmd.exe PID 2184 wrote to memory of 2548 2184 Photoshop.exe cmd.exe PID 2548 wrote to memory of 2664 2548 cmd.exe mode.com PID 2548 wrote to memory of 2664 2548 cmd.exe mode.com PID 2548 wrote to memory of 2664 2548 cmd.exe mode.com PID 2548 wrote to memory of 2680 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2680 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2680 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2576 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2576 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2576 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2476 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2476 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2476 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2196 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2196 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2196 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2440 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2440 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2440 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2908 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2908 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 2908 2548 cmd.exe 7z.exe PID 2548 wrote to memory of 1848 2548 cmd.exe attrib.exe PID 2548 wrote to memory of 1848 2548 cmd.exe attrib.exe PID 2548 wrote to memory of 1848 2548 cmd.exe attrib.exe PID 2548 wrote to memory of 1996 2548 cmd.exe nmYIeCI7gcMH.exe PID 2548 wrote to memory of 1996 2548 cmd.exe nmYIeCI7gcMH.exe PID 2548 wrote to memory of 1996 2548 cmd.exe nmYIeCI7gcMH.exe PID 2548 wrote to memory of 1996 2548 cmd.exe nmYIeCI7gcMH.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe PID 1996 wrote to memory of 2268 1996 nmYIeCI7gcMH.exe RegSvcs.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"C:\Users\Admin\AppData\Local\Temp\Photoshop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\system32\mode.commode 65,103⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p125762329330388294023250819845 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2908 -
C:\Windows\system32\attrib.exeattrib +H "nmYIeCI7gcMH.exe"3⤵
- Views/modifies file attributes
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe"nmYIeCI7gcMH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:2268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
Filesize
2.2MB
MD547e8ed572da00474326b4cee8f85b005
SHA194bceabdc880c41d73d6c984a9d61c31dd29ce91
SHA256abd52eb132c8c23669233a656f036a0e07692efd398894b724b61b66a75564af
SHA51231da04b57f0ef1b3363a3fa4855ca576d9159d374de0d2d9defb5524e67fed740441dcc2245a246daecab6260a419c02a32770ee9be53a2ddbede9dd4848d624
-
Filesize
509KB
MD55f79b89dbaf23387caa818b0da7b8ea2
SHA13c38d94819331fd551c07048841cfe6ecbf29e18
SHA2567abc58d9dd3dee48f88629c8dcaf12e72a337f8bf1dbce59d464ab6ed698b726
SHA512a6381f3b0d3184ab098e9a40ca65dd1cec76cb7e0cfe13a5c2d188e4c8e6d077286c70a366ad6ffc7e7f68faa6240a730b7034fcaa00d1c1f0922e42c1edb8fc
-
Filesize
509KB
MD5763cb011f068f184a672e254d3ce3c39
SHA159eb148e6ad321cac5396e6a58c1528f7932befb
SHA256d25782f4a9573c40747458b6916e9332b34a349b3011ec85dd5d11a583a87105
SHA512530b8c0ad90b53f38cd56ffaf3766f33167c9922e55f8485ca87019275730c94dd6a84a1d9578163c45bae2743cf6981041f9ccc97ceb822f8d607f94a0c1d28
-
Filesize
509KB
MD5210ee7f34c0ff268d33d598a49eb889a
SHA1876dea438f3f365513159630a12a2192fecd8b7f
SHA2569d8ee7edf36676633d624774cb194a45ef8ae286cb5e9591d46c20be57a9282f
SHA512383bb66f996b858d4ef23eed2264c4f890d47aca7b3da88587e3bb6454183f8d35e44411b08eecafe3fbb0638610cd872d1d00402dd8ff0b660102a44b53bcb1
-
Filesize
509KB
MD54ab6b1ed8f26df37c531a80147982511
SHA125d59710197c30eee836096dfcce139ba84f978a
SHA25633f73488015443cc05fa02d1c0723921502de5cac3206cf9fc433472a2afb162
SHA512a582e4cd93baf45b48aad086ffc5edab4ec899cbd029e9e740e93cf34a2aff492f14c92ed2efc0339fc4eed979311600007fca3075abda28232d9d351dd49e24
-
Filesize
2.1MB
MD59e57c6bb6dfb456cd9907844b7afafbd
SHA1daee76439ed4cd77192dc5c2d52b187f18e5ba99
SHA256729dbb0bd855dc1c1cf59366f49e29cb2b6e0d1279270924d2b131d7df749eab
SHA5123a99dae0a7c4ac47c5143dd6ada9a485cf115d3d9b172c3ba6d0847d6848e41defccd3a4eaf1b44c3ae46820c2164127b4e1ceaa5e07a8028e9b38f823a5960b
-
Filesize
619KB
MD553c6cf5bf9ce4922b3dc9bf9cc2374a2
SHA1b9a0d229a47fadaaa0898d32dce3aac279ac8569
SHA2562bb1a0a95249e3bcca1fdfc740bc91df10dc9c8cd834707a0b5a31883eb6867e
SHA512d323cfdfc3db5c5ce70ba572c0c657def11c3b36703a029977f5c5ddfdb278dfd1eea8950686d7a566dcd550aa0c854ceb035e6e67fcb377a8fc50dc4e0cd64c
-
Filesize
2.1MB
MD5afaebf70e6daf7bf2e07cd11f93ee4a1
SHA14e8b08b3e50f860955bd00d16fc1653c07b7c608
SHA2564a9d76fb9d77efaf81616e750b928ba3955599acafb2c0fec0d7ce412db0f47b
SHA5124db3a63f03f8816b85fdb905e2a2f08967f9f3735206f08f2cae8b8cd561e8563d2f92c188d32b94fdb6d472e07c5f41f54e26673f8a81449454225220ba397f
-
Filesize
491B
MD512b875e85a885c81bc04161e9df9151a
SHA17d9e32a575e487611abb182b4d89b1ab4f4e7a06
SHA25697e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5
SHA5123ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca
-
Filesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628