Analysis

  • max time kernel
    155s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-03-2024 02:49

General

  • Target

    d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe

  • Size

    3.0MB

  • MD5

    a8048bd6fc7d336d7f6e0fd6800da673

  • SHA1

    f28db14f2884ac1db0ce53a7ec7bee572541d902

  • SHA256

    d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d

  • SHA512

    570d1ac52dcb8f6c67983a4af99fece9f47e03beba83b9b2c95ce544f5b5f40c8c7e46019f5e106b258de2affee91988053dbab9e777e1c115d3803513eea066

  • SSDEEP

    49152:zR5PaMqlX9BK+ndEBk6/HOg7wFXW3zrFlvmh+JJRV8EeCrXy7295sAZub1R:zR59qtaBk0HOXXWHbbbrNub

Score
10/10

Malware Config

Signatures

  • Detect Poverty Stealer Payload 4 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe
    "C:\Users\Admin\AppData\Local\Temp\d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Windows\system32\mode.com
        mode 65,10
        3⤵
          PID:2480
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e file.zip -p125762329330388294023250819845 -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_5.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2688
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_4.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3832
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_3.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4908
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_2.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1188
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_1.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1564
        • C:\Windows\system32\attrib.exe
          attrib +H "nmYIeCI7gcMH.exe"
          3⤵
          • Views/modifies file attributes
          PID:4196
        • C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
          "nmYIeCI7gcMH.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:456
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            4⤵
              PID:1572
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2528 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:4796

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

          Filesize

          1.6MB

          MD5

          72491c7b87a7c2dd350b727444f13bb4

          SHA1

          1e9338d56db7ded386878eab7bb44b8934ab1bc7

          SHA256

          34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

          SHA512

          583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

          Filesize

          1.2MB

          MD5

          58c64162de8c8095b323a5ac4575542b

          SHA1

          8e787e92b68a31c6e904df296ece4b9b9372fed8

          SHA256

          991278e242f80246b4f611db272953ce5aa09bd5efa980a961d2020882412081

          SHA512

          7a3f891729e6afbc0d6aaa81f7c56cd50cabdd4bbb97f83625e3936b22d6614c3e3d41767a6465d32348512c2d43639a4b07340060f63f2ab817e57a77df9bfa

        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

          Filesize

          903KB

          MD5

          f92a01146e70f5220056880dbfe47378

          SHA1

          d1206f967b709fec3919fa62049122d35eb306ed

          SHA256

          77680fcf3cbb6ca7219b16a4c0b769f25dfe0fa48766ce319366ec9c24d8ae2a

          SHA512

          528aa27899ef37e35b8970fcf4433b0512f03ac95275be8cb9dc58250100c1468c96d71321a5bc071413ce8594c53230aa3abaef918a1a13b547b9ca8e08430a

        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

          Filesize

          969KB

          MD5

          f99cd2846a589782a883acc1dfe33853

          SHA1

          afee0bb78a10451ae637d572fccfc5b7eb10ea78

          SHA256

          394ab7dff77a979c989abed153222517d8180e4b3834b508ab58979f62964358

          SHA512

          08480820ab4296c7fbadc1611ccb3806ddec5dcf16540520a62bfb2d75b3e1ef16f78154daf4472a11eff5807ff17f98e439bec5401ee4e4934cea6302ffb273

        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

          Filesize

          458KB

          MD5

          619f7135621b50fd1900ff24aade1524

          SHA1

          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

          SHA256

          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

          SHA512

          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

          Filesize

          769KB

          MD5

          c07dcdde40984587819aa7b8bf3ad8aa

          SHA1

          558f1b0fb89ed55740373ee590da3e5692f14448

          SHA256

          19816cdb8279a63b9197014d771580cd2dc006bc0f7c725f3f097f04ec62e50c

          SHA512

          db71971204c5e7b2d9c08dec1fc587f8cc35e842e0cf404f530e3e756558070796bb89a07870c0c5066209807e75ed6e7f1a593818f0c6ace37bad6d35fb8617

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

          Filesize

          509KB

          MD5

          5f79b89dbaf23387caa818b0da7b8ea2

          SHA1

          3c38d94819331fd551c07048841cfe6ecbf29e18

          SHA256

          7abc58d9dd3dee48f88629c8dcaf12e72a337f8bf1dbce59d464ab6ed698b726

          SHA512

          a6381f3b0d3184ab098e9a40ca65dd1cec76cb7e0cfe13a5c2d188e4c8e6d077286c70a366ad6ffc7e7f68faa6240a730b7034fcaa00d1c1f0922e42c1edb8fc

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

          Filesize

          509KB

          MD5

          763cb011f068f184a672e254d3ce3c39

          SHA1

          59eb148e6ad321cac5396e6a58c1528f7932befb

          SHA256

          d25782f4a9573c40747458b6916e9332b34a349b3011ec85dd5d11a583a87105

          SHA512

          530b8c0ad90b53f38cd56ffaf3766f33167c9922e55f8485ca87019275730c94dd6a84a1d9578163c45bae2743cf6981041f9ccc97ceb822f8d607f94a0c1d28

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

          Filesize

          509KB

          MD5

          210ee7f34c0ff268d33d598a49eb889a

          SHA1

          876dea438f3f365513159630a12a2192fecd8b7f

          SHA256

          9d8ee7edf36676633d624774cb194a45ef8ae286cb5e9591d46c20be57a9282f

          SHA512

          383bb66f996b858d4ef23eed2264c4f890d47aca7b3da88587e3bb6454183f8d35e44411b08eecafe3fbb0638610cd872d1d00402dd8ff0b660102a44b53bcb1

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

          Filesize

          509KB

          MD5

          4ab6b1ed8f26df37c531a80147982511

          SHA1

          25d59710197c30eee836096dfcce139ba84f978a

          SHA256

          33f73488015443cc05fa02d1c0723921502de5cac3206cf9fc433472a2afb162

          SHA512

          a582e4cd93baf45b48aad086ffc5edab4ec899cbd029e9e740e93cf34a2aff492f14c92ed2efc0339fc4eed979311600007fca3075abda28232d9d351dd49e24

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

          Filesize

          2.1MB

          MD5

          9e57c6bb6dfb456cd9907844b7afafbd

          SHA1

          daee76439ed4cd77192dc5c2d52b187f18e5ba99

          SHA256

          729dbb0bd855dc1c1cf59366f49e29cb2b6e0d1279270924d2b131d7df749eab

          SHA512

          3a99dae0a7c4ac47c5143dd6ada9a485cf115d3d9b172c3ba6d0847d6848e41defccd3a4eaf1b44c3ae46820c2164127b4e1ceaa5e07a8028e9b38f823a5960b

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\nmYIeCI7gcMH.exe

          Filesize

          471KB

          MD5

          8450038d62cc82bca8b4fa0b74dd54fb

          SHA1

          8ac42de685d7a67cb294218c640f5b76b59d432b

          SHA256

          6f09fa31ac0a84d2dd8c370a85ff51b1454ebec6ea468d57b2a8668294d937fc

          SHA512

          50f00a1bda0865b8100af94ec6746ac7045caadb42620f76bb1028b3730a4ac42b380fc8f1906fe2bc9cde6d064456a0828271f3387b0f33a48d60eee8bb34cd

        • C:\Users\Admin\AppData\Local\Temp\main\file.bin

          Filesize

          2.1MB

          MD5

          afaebf70e6daf7bf2e07cd11f93ee4a1

          SHA1

          4e8b08b3e50f860955bd00d16fc1653c07b7c608

          SHA256

          4a9d76fb9d77efaf81616e750b928ba3955599acafb2c0fec0d7ce412db0f47b

          SHA512

          4db3a63f03f8816b85fdb905e2a2f08967f9f3735206f08f2cae8b8cd561e8563d2f92c188d32b94fdb6d472e07c5f41f54e26673f8a81449454225220ba397f

        • C:\Users\Admin\AppData\Local\Temp\main\main.bat

          Filesize

          491B

          MD5

          12b875e85a885c81bc04161e9df9151a

          SHA1

          7d9e32a575e487611abb182b4d89b1ab4f4e7a06

          SHA256

          97e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5

          SHA512

          3ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca

        • C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe

          Filesize

          461KB

          MD5

          26f3342626852a3f1c0ad5c08bd8ded7

          SHA1

          4689678d8940491473161222f232dfb108bc5262

          SHA256

          f9e1d5f1e56b0cd9744d8168a05031b1771acce536e7856ef817f807b64002f3

          SHA512

          ef7e7c3341ba4f3c2d6d21c4082b6a9ea18c93a9d40f68edc7944c091214224ed1071008d81d287be55a5a11940dff7d49fee92e3ffdd863797346662efe3644

        • memory/456-63-0x0000000001070000-0x0000000001170000-memory.dmp

          Filesize

          1024KB

        • memory/1572-64-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/1572-70-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/1572-71-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/1572-72-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB