Analysis Overview
SHA256
520232b86cb77319d9c8b1fb5eb54c39418a5405e12a9e012d321e1ad9750be8
Threat Level: Known bad
The file 20c65c429a3d149bc95caaece5bf8986.bin was found to be: Known bad.
Malicious Activity Summary
Detect Poverty Stealer Payload
Poverty Stealer
Reads user/profile data of web browsers
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-08 01:03
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-08 01:03
Reported
2024-04-08 01:05
Platform
win7-20240215-en
Max time kernel
121s
Max time network
123s
Command Line
Signatures
Detect Poverty Stealer Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Poverty Stealer
Reads user/profile data of web browsers
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe
"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"
Network
| Country | Destination | Domain | Proto |
| DE | 146.70.169.164:2227 | tcp |
Files
memory/2760-0-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2760-2-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2760-4-0x0000000001220000-0x0000000001D15000-memory.dmp
memory/2760-5-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2760-6-0x0000000000140000-0x0000000000141000-memory.dmp
memory/2760-8-0x0000000000140000-0x0000000000141000-memory.dmp
memory/2760-10-0x0000000000140000-0x0000000000141000-memory.dmp
memory/2760-13-0x0000000000150000-0x0000000000151000-memory.dmp
memory/2760-15-0x0000000000150000-0x0000000000151000-memory.dmp
memory/2760-23-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2760-20-0x0000000000160000-0x0000000000161000-memory.dmp
memory/2760-30-0x0000000000200000-0x0000000000201000-memory.dmp
memory/2760-28-0x0000000000200000-0x0000000000201000-memory.dmp
memory/2760-25-0x0000000000170000-0x0000000000171000-memory.dmp
memory/2760-18-0x0000000000160000-0x0000000000161000-memory.dmp
memory/2760-35-0x0000000001220000-0x0000000001D15000-memory.dmp
memory/2760-36-0x0000000000310000-0x0000000000311000-memory.dmp
memory/2760-37-0x0000000001220000-0x0000000001D15000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-08 01:03
Reported
2024-04-08 01:05
Platform
win10v2004-20240226-en
Max time kernel
94s
Max time network
96s
Command Line
Signatures
Detect Poverty Stealer Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Poverty Stealer
Reads user/profile data of web browsers
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe
"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| DE | 146.70.169.164:2227 | tcp | |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 164.169.70.146.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
memory/4320-2-0x0000000000E70000-0x0000000001965000-memory.dmp
memory/4320-1-0x0000000000860000-0x0000000000861000-memory.dmp
memory/4320-0-0x0000000000850000-0x0000000000851000-memory.dmp
memory/4320-4-0x0000000000E70000-0x0000000001965000-memory.dmp
memory/4320-3-0x0000000000890000-0x0000000000891000-memory.dmp
memory/4320-5-0x00000000008A0000-0x00000000008A1000-memory.dmp
memory/4320-6-0x0000000000E50000-0x0000000000E51000-memory.dmp
memory/4320-7-0x0000000000E60000-0x0000000000E61000-memory.dmp
memory/4320-12-0x0000000000E70000-0x0000000001965000-memory.dmp
memory/4320-13-0x0000000003080000-0x0000000003081000-memory.dmp
memory/4320-14-0x0000000000E70000-0x0000000001965000-memory.dmp