Analysis

  • max time kernel
    153s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-03-2024 14:29

General

  • Target

    308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe

  • Size

    1.7MB

  • MD5

    ab5503f5793b4e4f67d78b6488c7ba9d

  • SHA1

    927f78f68f0ab828c22c58fad6bcf88e1e48c672

  • SHA256

    308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236

  • SHA512

    7ebe818801e7dfe583023d0c71ff0d048c62be578d4b767f5cea92576bb6f787a6ab762d4af78301e5f247f45cf8e523ec8de05cc8c50707073af7aee78c8742

  • SSDEEP

    24576:7uAkyAYueOQUzE5lZKw6PZAeWAGQn652ROuBiTmcLljVIH06iyz:pThulIZKw6qrANrs1LXIU6i

Malware Config

Signatures

  • Detect Poverty Stealer Payload 2 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • GoLang User-Agent 5 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe
    "C:\Users\Admin\AppData\Local\Temp\308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\SysWoW64\calc.exe
      C:\Windows\SysWoW64\calc.exe
      2⤵
      • Executes dropped EXE
      PID:4872
    • C:\Windows\SysWoW64\calc.exe
      C:\Windows\SysWoW64\calc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Windows\SysWoW64\calc.exe\" }"
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1796
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2276

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\THC2C4B.tmp

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvavxqju.llb.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/868-0-0x000001F954370000-0x000001F954373000-memory.dmp

      Filesize

      12KB

    • memory/1796-12-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB

    • memory/1796-32-0x0000000073E30000-0x00000000745E0000-memory.dmp

      Filesize

      7.7MB

    • memory/1796-47-0x0000000073E30000-0x00000000745E0000-memory.dmp

      Filesize

      7.7MB

    • memory/1796-10-0x0000000073E30000-0x00000000745E0000-memory.dmp

      Filesize

      7.7MB

    • memory/1796-43-0x0000000007B60000-0x0000000008104000-memory.dmp

      Filesize

      5.6MB

    • memory/1796-13-0x0000000001490000-0x00000000014C6000-memory.dmp

      Filesize

      216KB

    • memory/1796-14-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB

    • memory/1796-15-0x00000000057C0000-0x0000000005DE8000-memory.dmp

      Filesize

      6.2MB

    • memory/1796-18-0x0000000005520000-0x0000000005542000-memory.dmp

      Filesize

      136KB

    • memory/1796-19-0x0000000005740000-0x00000000057A6000-memory.dmp

      Filesize

      408KB

    • memory/1796-20-0x0000000005EF0000-0x0000000005F56000-memory.dmp

      Filesize

      408KB

    • memory/1796-42-0x0000000006A30000-0x0000000006A52000-memory.dmp

      Filesize

      136KB

    • memory/1796-27-0x0000000005FA0000-0x00000000062F4000-memory.dmp

      Filesize

      3.3MB

    • memory/1796-41-0x0000000006920000-0x000000000693A000-memory.dmp

      Filesize

      104KB

    • memory/1796-34-0x00000000065A0000-0x00000000065BE000-memory.dmp

      Filesize

      120KB

    • memory/1796-35-0x0000000006970000-0x00000000069BC000-memory.dmp

      Filesize

      304KB

    • memory/1796-37-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB

    • memory/1796-38-0x0000000005180000-0x0000000005190000-memory.dmp

      Filesize

      64KB

    • memory/1796-40-0x0000000006AD0000-0x0000000006B66000-memory.dmp

      Filesize

      600KB

    • memory/3124-8-0x00000000008D0000-0x00000000010EC000-memory.dmp

      Filesize

      8.1MB

    • memory/3124-5-0x00000000008D0000-0x00000000010EC000-memory.dmp

      Filesize

      8.1MB

    • memory/3124-49-0x00000000008D0000-0x00000000010EC000-memory.dmp

      Filesize

      8.1MB

    • memory/3124-55-0x00000000008D0000-0x00000000010EC000-memory.dmp

      Filesize

      8.1MB

    • memory/3124-57-0x00000000008D0000-0x00000000010EC000-memory.dmp

      Filesize

      8.1MB

    • memory/3124-62-0x00000000008D0000-0x00000000010EC000-memory.dmp

      Filesize

      8.1MB

    • memory/4872-7-0x00000000009D0000-0x00000000009DA000-memory.dmp

      Filesize

      40KB

    • memory/4872-9-0x00000000009D0000-0x00000000009DA000-memory.dmp

      Filesize

      40KB