Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-04-2024 16:26

General

  • Target

    20c65c429a3d149bc95caaece5bf8986.exe

  • Size

    5.7MB

  • MD5

    20c65c429a3d149bc95caaece5bf8986

  • SHA1

    fc0cf8466e1175c028e2d26caf7ba6628059e36c

  • SHA256

    448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d

  • SHA512

    919e3f8d3fe2d3c6051ea55b3e3fac9820cc50aa0ec329b6b8c38fa32a2fa49256fac354865121a6056ea61f2d3923b27127b0bfd621252d384178b8253114bc

  • SSDEEP

    98304:WtDA1meYKbLw3gx6jVoK5wrcnJecmeNgqwPPJrh13AuyulToWaxIo/Kgp7TnEswU:p1kKXjxLwRnJLwrUuy4TyKg7TnE7Bb49

Malware Config

Signatures

  • Detect Poverty Stealer Payload 4 IoCs
  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20c65c429a3d149bc95caaece5bf8986.exe
    "C:\Users\Admin\AppData\Local\Temp\20c65c429a3d149bc95caaece5bf8986.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2160-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/2160-2-0x00000000010C0000-0x0000000001BB5000-memory.dmp

    Filesize

    11.0MB

  • memory/2160-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/2160-6-0x00000000010C0000-0x0000000001BB5000-memory.dmp

    Filesize

    11.0MB

  • memory/2160-7-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/2160-5-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/2160-11-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/2160-9-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/2160-14-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2160-16-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/2160-19-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2160-21-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2160-24-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2160-26-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2160-29-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2160-31-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2160-36-0x00000000010C0000-0x0000000001BB5000-memory.dmp

    Filesize

    11.0MB

  • memory/2160-37-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/2160-38-0x00000000010C0000-0x0000000001BB5000-memory.dmp

    Filesize

    11.0MB