Malware Analysis Report

2024-10-19 02:41

Sample ID 240407-bhtvbsgf5z
Target 448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe
SHA256 448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d
Tags
povertystealer spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d

Threat Level: Known bad

The file 448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe was found to be: Known bad.

Malicious Activity Summary

povertystealer spyware stealer

Detect Poverty Stealer Payload

Poverty Stealer

Reads user/profile data of web browsers

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-07 01:09

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-07 01:09

Reported

2024-04-07 01:11

Platform

win7-20240220-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

Reads user/profile data of web browsers

spyware stealer

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Network

Country Destination Domain Proto
DE 146.70.169.164:2227 tcp

Files

memory/2176-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/2176-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/2176-2-0x0000000000CD0000-0x00000000017C5000-memory.dmp

memory/2176-6-0x00000000000F0000-0x00000000000F1000-memory.dmp

memory/2176-5-0x0000000000CD0000-0x00000000017C5000-memory.dmp

memory/2176-7-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2176-9-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2176-11-0x0000000000100000-0x0000000000101000-memory.dmp

memory/2176-16-0x0000000000110000-0x0000000000111000-memory.dmp

memory/2176-14-0x0000000000110000-0x0000000000111000-memory.dmp

memory/2176-19-0x0000000000120000-0x0000000000121000-memory.dmp

memory/2176-31-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2176-29-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2176-26-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2176-24-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2176-21-0x0000000000120000-0x0000000000121000-memory.dmp

memory/2176-36-0x0000000000CD0000-0x00000000017C5000-memory.dmp

memory/2176-37-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2176-38-0x0000000000CD0000-0x00000000017C5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-07 01:09

Reported

2024-04-07 01:11

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

Reads user/profile data of web browsers

spyware stealer

Processes

C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 242.137.73.23.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
DE 146.70.169.164:2227 tcp
US 8.8.8.8:53 164.169.70.146.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/3456-0-0x00000000019E0000-0x00000000019E1000-memory.dmp

memory/3456-1-0x0000000000AA0000-0x0000000001595000-memory.dmp

memory/3456-2-0x0000000003490000-0x0000000003491000-memory.dmp

memory/3456-3-0x00000000034C0000-0x00000000034C1000-memory.dmp

memory/3456-5-0x00000000034D0000-0x00000000034D1000-memory.dmp

memory/3456-4-0x0000000000AA0000-0x0000000001595000-memory.dmp

memory/3456-7-0x00000000034F0000-0x00000000034F1000-memory.dmp

memory/3456-6-0x00000000034E0000-0x00000000034E1000-memory.dmp

memory/3456-12-0x0000000000AA0000-0x0000000001595000-memory.dmp

memory/3456-13-0x0000000003500000-0x0000000003501000-memory.dmp

memory/3456-14-0x0000000000AA0000-0x0000000001595000-memory.dmp