poullight | a93b695b8578516cc724273a2094d4130768a957310167383b099f6859558c84

Analysis

max time kernel
143s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
Size

954KB
MD5

3da0cddc659c276b12782372d135f34f
SHA1

3ab26c8831341fe28ce90a854d9c4f89400e5032
SHA256

a93b695b8578516cc724273a2094d4130768a957310167383b099f6859558c84
SHA512

1b3ab172f4b1f03b20669160d827bddb32639c4f54f099d4cc4cca812702fcaeaf47ef9837407c0e63a1463f5d86d52a8d1f0507a6988f0e6f1e67e4c1d982e6
SSDEEP

24576:Hy3g5Lt2xAY1/j/33YoOCkmlhbelDF/ShJdERb2IUB3kE9:Sw5LaAY1/j/naZlDlShuBU26

Score

10^/10

poullight spyware stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2140-2-0x00000000012E0000-0x0000000001664000-memory.dmp	family_poullight

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2140	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8dlv4tmdcut7vv

Filesize
92KB

MD5
2157696941ae13875f8dfe8630ea4029

SHA1
b5ff62b7900cdfc630edd94d737309042de58251

SHA256
90e438a9d6706c8a1e809bfb5babe83508cac27d3c9f3f9b8bd1cd4f3aa3e033

SHA512
61b998e42f5d0121f75e04a46177c1c3a7122dc2014b7bed1d584c9ea53146e87d7a6b9e94bde066d92580c6c2b2316dd860980e5cd8f75984286dc90e43fb6a

Download Submit
C:\Users\Admin\AppData\Local\afsfo9vg\Skype\data.txt

Filesize
55B

MD5
f42b48302a71c9b07559c714520a5691

SHA1
56961243dbdfd2663ff593367170eddd789acf53

SHA256
16c37c7a818dd689367d4c89d548338818b839bde3b2f0498dc8c854097d34a7

SHA512
a84dcda6a4f4dcf8968e123f173b4db2b2700e9ceb7787488c6d46ec2404096e59807f6878f6b6d7613cc838e5ce13be932771578a4f088ad59492eba9094504

Download Submit
memory/2140-0-0x00000000012E0000-0x0000000001664000-memory.dmp

Filesize
3.5MB

Download
memory/2140-1-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

Filesize
4KB

Download
memory/2140-2-0x00000000012E0000-0x0000000001664000-memory.dmp

Filesize
3.5MB

Download
memory/2140-3-0x0000000073E50000-0x000000007453E000-memory.dmp

Filesize
6.9MB

Download
memory/2140-62-0x00000000012E0000-0x0000000001664000-memory.dmp

Filesize
3.5MB

Download
memory/2140-63-0x0000000073E5E000-0x0000000073E5F000-memory.dmp

Filesize
4KB

Download
memory/2140-64-0x0000000073E50000-0x000000007453E000-memory.dmp

Filesize
6.9MB

Download