Malware Analysis Report

2024-10-19 02:41

Sample ID 240408-behmwscb27
Target 20c65c429a3d149bc95caaece5bf8986.bin
SHA256 520232b86cb77319d9c8b1fb5eb54c39418a5405e12a9e012d321e1ad9750be8
Tags
povertystealer spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

520232b86cb77319d9c8b1fb5eb54c39418a5405e12a9e012d321e1ad9750be8

Threat Level: Known bad

The file 20c65c429a3d149bc95caaece5bf8986.bin was found to be: Known bad.

Malicious Activity Summary

povertystealer spyware stealer

Detect Poverty Stealer Payload

Poverty Stealer

Reads user/profile data of web browsers

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 01:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 01:03

Reported

2024-04-08 01:05

Platform

win7-20240215-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

Reads user/profile data of web browsers

spyware stealer

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Network

Country Destination Domain Proto
DE 146.70.169.164:2227 tcp

Files

memory/2760-0-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2760-2-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2760-4-0x0000000001220000-0x0000000001D15000-memory.dmp

memory/2760-5-0x0000000000130000-0x0000000000131000-memory.dmp

memory/2760-6-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2760-8-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2760-10-0x0000000000140000-0x0000000000141000-memory.dmp

memory/2760-13-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2760-15-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2760-23-0x0000000000170000-0x0000000000171000-memory.dmp

memory/2760-20-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2760-30-0x0000000000200000-0x0000000000201000-memory.dmp

memory/2760-28-0x0000000000200000-0x0000000000201000-memory.dmp

memory/2760-25-0x0000000000170000-0x0000000000171000-memory.dmp

memory/2760-18-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2760-35-0x0000000001220000-0x0000000001D15000-memory.dmp

memory/2760-36-0x0000000000310000-0x0000000000311000-memory.dmp

memory/2760-37-0x0000000001220000-0x0000000001D15000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 01:03

Reported

2024-04-08 01:05

Platform

win10v2004-20240226-en

Max time kernel

94s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Signatures

Detect Poverty Stealer Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Poverty Stealer

stealer povertystealer

Reads user/profile data of web browsers

spyware stealer

Processes

C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe

"C:\Users\Admin\AppData\Local\Temp\448a14d6ee35da26c5659cf4253d4bcd97737ab502c6195b65d3e14451ab3e0d.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
DE 146.70.169.164:2227 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 164.169.70.146.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4320-2-0x0000000000E70000-0x0000000001965000-memory.dmp

memory/4320-1-0x0000000000860000-0x0000000000861000-memory.dmp

memory/4320-0-0x0000000000850000-0x0000000000851000-memory.dmp

memory/4320-4-0x0000000000E70000-0x0000000001965000-memory.dmp

memory/4320-3-0x0000000000890000-0x0000000000891000-memory.dmp

memory/4320-5-0x00000000008A0000-0x00000000008A1000-memory.dmp

memory/4320-6-0x0000000000E50000-0x0000000000E51000-memory.dmp

memory/4320-7-0x0000000000E60000-0x0000000000E61000-memory.dmp

memory/4320-12-0x0000000000E70000-0x0000000001965000-memory.dmp

memory/4320-13-0x0000000003080000-0x0000000003081000-memory.dmp

memory/4320-14-0x0000000000E70000-0x0000000001965000-memory.dmp