povertystealer | 31faa0fee4913ec40074988c164a361d45bbc434ff9345328fc126d3e5ede84b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe
Size

3.0MB
MD5

a8048bd6fc7d336d7f6e0fd6800da673
SHA1

f28db14f2884ac1db0ce53a7ec7bee572541d902
SHA256

d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d
SHA512

570d1ac52dcb8f6c67983a4af99fece9f47e03beba83b9b2c95ce544f5b5f40c8c7e46019f5e106b258de2affee91988053dbab9e777e1c115d3803513eea066
SSDEEP

49152:zR5PaMqlX9BK+ndEBk6/HOg7wFXW3zrFlvmh+JJRV8EeCrXy7295sAZub1R:zR59qtaBk0HOXXWHbbbrNub

Score

10^/10

povertystealer stealer

Malware Config

Signatures

Detect Poverty Stealer Payload 4 IoCs

resource	yara_rule
behavioral2/memory/4848-63-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4848-70-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4848-72-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/4848-71-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe

Executes dropped EXE 7 IoCs

pid	Process
392	7z.exe
2776	7z.exe
3196	7z.exe
4836	7z.exe
4200	7z.exe
1992	7z.exe
4008	nmYIeCI7gcMH.exe

Loads dropped DLL 6 IoCs

pid	Process
392	7z.exe
2776	7z.exe
3196	7z.exe
4836	7z.exe
4200	7z.exe
1992	7z.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4008 set thread context of 4848	4008	nmYIeCI7gcMH.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeRestorePrivilege	392	7z.exe
Token: 35	392	7z.exe
Token: SeSecurityPrivilege	392	7z.exe
Token: SeSecurityPrivilege	392	7z.exe
Token: SeRestorePrivilege	2776	7z.exe
Token: 35	2776	7z.exe
Token: SeSecurityPrivilege	2776	7z.exe
Token: SeSecurityPrivilege	2776	7z.exe
Token: SeRestorePrivilege	3196	7z.exe
Token: 35	3196	7z.exe
Token: SeSecurityPrivilege	3196	7z.exe
Token: SeSecurityPrivilege	3196	7z.exe
Token: SeRestorePrivilege	4836	7z.exe
Token: 35	4836	7z.exe
Token: SeSecurityPrivilege	4836	7z.exe
Token: SeSecurityPrivilege	4836	7z.exe
Token: SeRestorePrivilege	4200	7z.exe
Token: 35	4200	7z.exe
Token: SeSecurityPrivilege	4200	7z.exe
Token: SeSecurityPrivilege	4200	7z.exe
Token: SeRestorePrivilege	1992	7z.exe
Token: 35	1992	7z.exe
Token: SeSecurityPrivilege	1992	7z.exe
Token: SeSecurityPrivilege	1992	7z.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4168	1624	d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe	92
PID 1624 wrote to memory of 4168	1624	d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe	92
PID 4168 wrote to memory of 2348	4168	cmd.exe	94
PID 4168 wrote to memory of 2348	4168	cmd.exe	94
PID 4168 wrote to memory of 392	4168	cmd.exe	95
PID 4168 wrote to memory of 392	4168	cmd.exe	95
PID 4168 wrote to memory of 2776	4168	cmd.exe	96
PID 4168 wrote to memory of 2776	4168	cmd.exe	96
PID 4168 wrote to memory of 3196	4168	cmd.exe	97
PID 4168 wrote to memory of 3196	4168	cmd.exe	97
PID 4168 wrote to memory of 4836	4168	cmd.exe	98
PID 4168 wrote to memory of 4836	4168	cmd.exe	98
PID 4168 wrote to memory of 4200	4168	cmd.exe	99
PID 4168 wrote to memory of 4200	4168	cmd.exe	99
PID 4168 wrote to memory of 1992	4168	cmd.exe	100
PID 4168 wrote to memory of 1992	4168	cmd.exe	100
PID 4168 wrote to memory of 2288	4168	cmd.exe	101
PID 4168 wrote to memory of 2288	4168	cmd.exe	101
PID 4168 wrote to memory of 4008	4168	cmd.exe	102
PID 4168 wrote to memory of 4008	4168	cmd.exe	102
PID 4168 wrote to memory of 4008	4168	cmd.exe	102
PID 4008 wrote to memory of 4848	4008	nmYIeCI7gcMH.exe	113
PID 4008 wrote to memory of 4848	4008	nmYIeCI7gcMH.exe	113
PID 4008 wrote to memory of 4848	4008	nmYIeCI7gcMH.exe	113
PID 4008 wrote to memory of 4848	4008	nmYIeCI7gcMH.exe	113
PID 4008 wrote to memory of 4848	4008	nmYIeCI7gcMH.exe	113

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2288	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe
"C:\Users\Admin\AppData\Local\Temp\d7414d6e34052bd4194ebf979a405af4e0d39b42b6d4d6ad31db85fd78dcc31d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\system32\mode.com
    mode 65,10
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e file.zip -p125762329330388294023250819845 -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_5.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_4.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_3.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_2.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
    7z.exe e extracted/file_1.zip -oextracted
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\system32\attrib.exe
    attrib +H "nmYIeCI7gcMH.exe"
    3⤵
    - Views/modifies file attributes
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe
    "nmYIeCI7gcMH.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

Filesize
2.2MB

MD5
47e8ed572da00474326b4cee8f85b005

SHA1
94bceabdc880c41d73d6c984a9d61c31dd29ce91

SHA256
abd52eb132c8c23669233a656f036a0e07692efd398894b724b61b66a75564af

SHA512
31da04b57f0ef1b3363a3fa4855ca576d9159d374de0d2d9defb5524e67fed740441dcc2245a246daecab6260a419c02a32770ee9be53a2ddbede9dd4848d624

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

Filesize
509KB

MD5
5f79b89dbaf23387caa818b0da7b8ea2

SHA1
3c38d94819331fd551c07048841cfe6ecbf29e18

SHA256
7abc58d9dd3dee48f88629c8dcaf12e72a337f8bf1dbce59d464ab6ed698b726

SHA512
a6381f3b0d3184ab098e9a40ca65dd1cec76cb7e0cfe13a5c2d188e4c8e6d077286c70a366ad6ffc7e7f68faa6240a730b7034fcaa00d1c1f0922e42c1edb8fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

Filesize
509KB

MD5
763cb011f068f184a672e254d3ce3c39

SHA1
59eb148e6ad321cac5396e6a58c1528f7932befb

SHA256
d25782f4a9573c40747458b6916e9332b34a349b3011ec85dd5d11a583a87105

SHA512
530b8c0ad90b53f38cd56ffaf3766f33167c9922e55f8485ca87019275730c94dd6a84a1d9578163c45bae2743cf6981041f9ccc97ceb822f8d607f94a0c1d28

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

Filesize
509KB

MD5
210ee7f34c0ff268d33d598a49eb889a

SHA1
876dea438f3f365513159630a12a2192fecd8b7f

SHA256
9d8ee7edf36676633d624774cb194a45ef8ae286cb5e9591d46c20be57a9282f

SHA512
383bb66f996b858d4ef23eed2264c4f890d47aca7b3da88587e3bb6454183f8d35e44411b08eecafe3fbb0638610cd872d1d00402dd8ff0b660102a44b53bcb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
509KB

MD5
4ab6b1ed8f26df37c531a80147982511

SHA1
25d59710197c30eee836096dfcce139ba84f978a

SHA256
33f73488015443cc05fa02d1c0723921502de5cac3206cf9fc433472a2afb162

SHA512
a582e4cd93baf45b48aad086ffc5edab4ec899cbd029e9e740e93cf34a2aff492f14c92ed2efc0339fc4eed979311600007fca3075abda28232d9d351dd49e24

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
2.1MB

MD5
9e57c6bb6dfb456cd9907844b7afafbd

SHA1
daee76439ed4cd77192dc5c2d52b187f18e5ba99

SHA256
729dbb0bd855dc1c1cf59366f49e29cb2b6e0d1279270924d2b131d7df749eab

SHA512
3a99dae0a7c4ac47c5143dd6ada9a485cf115d3d9b172c3ba6d0847d6848e41defccd3a4eaf1b44c3ae46820c2164127b4e1ceaa5e07a8028e9b38f823a5960b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
2.1MB

MD5
afaebf70e6daf7bf2e07cd11f93ee4a1

SHA1
4e8b08b3e50f860955bd00d16fc1653c07b7c608

SHA256
4a9d76fb9d77efaf81616e750b928ba3955599acafb2c0fec0d7ce412db0f47b

SHA512
4db3a63f03f8816b85fdb905e2a2f08967f9f3735206f08f2cae8b8cd561e8563d2f92c188d32b94fdb6d472e07c5f41f54e26673f8a81449454225220ba397f

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
491B

MD5
12b875e85a885c81bc04161e9df9151a

SHA1
7d9e32a575e487611abb182b4d89b1ab4f4e7a06

SHA256
97e80e083ba83a031bb03097cd81d86708165cd7eb1c070782e6a7234de784a5

SHA512
3ba38a4024287bcaeee208a1c0158fae73a86d5581cf566309985bbd204e810eb5fd099a1816a9326c9e25bb08a2da20f2a4884978eb4e4ed8a3762c1057d0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\nmYIeCI7gcMH.exe

Filesize
619KB

MD5
53c6cf5bf9ce4922b3dc9bf9cc2374a2

SHA1
b9a0d229a47fadaaa0898d32dce3aac279ac8569

SHA256
2bb1a0a95249e3bcca1fdfc740bc91df10dc9c8cd834707a0b5a31883eb6867e

SHA512
d323cfdfc3db5c5ce70ba572c0c657def11c3b36703a029977f5c5ddfdb278dfd1eea8950686d7a566dcd550aa0c854ceb035e6e67fcb377a8fc50dc4e0cd64c

Download Submit
memory/4008-64-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/4848-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4848-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4848-72-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4848-71-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4848-75-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download