poullight | 34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
Size

1.1MB
MD5

06e5c0fde2cd7ee930b1049831cf8da8
SHA1

fa2350fc18cdf1f934bb8fc625578c6c38e33728
SHA256

34cc348b9fa48a35e10b1c1333ce9fc63aefca3e06983b31f7f01ad8af3996d1
SHA512

751868ec358664e3b167b6c48daae7b1682cc67c944adea8d1d825520877eeafa8feeefb09d7f21760f00b7073d7606bd9fcbd305d9c06f99df988802a354323
SSDEEP

24576:DS9R//SNu76MKjZ6SfLotRZj/G9L4UMt/7CRNRN0rU31H1HNAvbSyiZ:DSXaNus96ILot3OB6CX0rU3XevRiZ

Score

10^/10

poullight spyware stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2812-1-0x0000000000E00000-0x0000000001182000-memory.dmp	family_poullight

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06e5c0fde2cd7ee930b1049831cf8da8_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wv96k5vej

Filesize
92KB

MD5
2157696941ae13875f8dfe8630ea4029

SHA1
b5ff62b7900cdfc630edd94d737309042de58251

SHA256
90e438a9d6706c8a1e809bfb5babe83508cac27d3c9f3f9b8bd1cd4f3aa3e033

SHA512
61b998e42f5d0121f75e04a46177c1c3a7122dc2014b7bed1d584c9ea53146e87d7a6b9e94bde066d92580c6c2b2316dd860980e5cd8f75984286dc90e43fb6a

Download Submit
C:\Users\Admin\AppData\Local\o70lktpf\Skype\data.txt

Filesize
55B

MD5
f42b48302a71c9b07559c714520a5691

SHA1
56961243dbdfd2663ff593367170eddd789acf53

SHA256
16c37c7a818dd689367d4c89d548338818b839bde3b2f0498dc8c854097d34a7

SHA512
a84dcda6a4f4dcf8968e123f173b4db2b2700e9ceb7787488c6d46ec2404096e59807f6878f6b6d7613cc838e5ce13be932771578a4f088ad59492eba9094504

Download Submit
memory/2812-0-0x0000000000E00000-0x0000000001182000-memory.dmp

Filesize
3.5MB

Download
memory/2812-1-0x0000000000E00000-0x0000000001182000-memory.dmp

Filesize
3.5MB

Download
memory/2812-2-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-3-0x0000000005960000-0x00000000059A0000-memory.dmp

Filesize
256KB

Download
memory/2812-60-0x0000000000E00000-0x0000000001182000-memory.dmp

Filesize
3.5MB

Download
memory/2812-61-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-62-0x0000000005960000-0x00000000059A0000-memory.dmp

Filesize
256KB

Download