Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 14:29
Static task
static1
Behavioral task
behavioral1
Sample
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe
Resource
win10v2004-20240226-en
General
-
Target
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe
-
Size
1.7MB
-
MD5
ab5503f5793b4e4f67d78b6488c7ba9d
-
SHA1
927f78f68f0ab828c22c58fad6bcf88e1e48c672
-
SHA256
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236
-
SHA512
7ebe818801e7dfe583023d0c71ff0d048c62be578d4b767f5cea92576bb6f787a6ab762d4af78301e5f247f45cf8e523ec8de05cc8c50707073af7aee78c8742
-
SSDEEP
24576:7uAkyAYueOQUzE5lZKw6PZAeWAGQn652ROuBiTmcLljVIH06iyz:pThulIZKw6qrANrs1LXIU6i
Malware Config
Signatures
-
Detect Poverty Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4872-7-0x00000000009D0000-0x00000000009DA000-memory.dmp family_povertystealer behavioral2/memory/4872-9-0x00000000009D0000-0x00000000009DA000-memory.dmp family_povertystealer -
Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
-
Executes dropped EXE 2 IoCs
Processes:
calc.execalc.exepid process 4872 calc.exe 3124 calc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\App = "C:\\Windows\\SysWoW64\\calc.exe" powershell.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exedescription ioc process File opened (read-only) \??\M: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\q: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\Q: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\r: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\R: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\u: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\g: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\G: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\X: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\P: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\J: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\p: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\E: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\k: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\L: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\n: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\T: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\v: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\a: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\B: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\Y: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\b: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\y: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\j: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\l: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\N: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\V: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\w: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\x: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\D: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\i: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\K: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\o: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\t: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\U: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\Z: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\e: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\H: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\I: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\m: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\O: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\s: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\W: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\z: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\F: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\h: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\A: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe File opened (read-only) \??\S: 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exedescription pid process target process PID 868 set thread context of 4872 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 set thread context of 3124 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe -
GoLang User-Agent 5 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 63 Go-http-client/1.1 HTTP User-Agent header 64 Go-http-client/1.1 HTTP User-Agent header 84 Go-http-client/1.1 HTTP User-Agent header 85 Go-http-client/1.1 HTTP User-Agent header 86 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exepowershell.exepid process 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe 1796 powershell.exe 1796 powershell.exe 1796 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1796 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.execalc.exedescription pid process target process PID 868 wrote to memory of 4872 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 4872 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 4872 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 4872 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 3124 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 3124 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 3124 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 868 wrote to memory of 3124 868 308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe calc.exe PID 3124 wrote to memory of 1796 3124 calc.exe powershell.exe PID 3124 wrote to memory of 1796 3124 calc.exe powershell.exe PID 3124 wrote to memory of 1796 3124 calc.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe"C:\Users\Admin\AppData\Local\Temp\308667b323852ff5bbc525f35b17882a49d175ab21f29c2cd1630b6986f4a236.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWoW64\calc.exeC:\Windows\SysWoW64\calc.exe2⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWoW64\calc.exeC:\Windows\SysWoW64\calc.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle hidden -Command "if (-Not (Test-Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\App\")) { Set-ItemProperty -Path \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" -Name \"App\" -Value \"C:\Windows\SysWoW64\calc.exe\" }"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:2276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82