poullight | a93b695b8578516cc724273a2094d4130768a957310167383b099f6859558c84

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
Size

954KB
MD5

3da0cddc659c276b12782372d135f34f
SHA1

3ab26c8831341fe28ce90a854d9c4f89400e5032
SHA256

a93b695b8578516cc724273a2094d4130768a957310167383b099f6859558c84
SHA512

1b3ab172f4b1f03b20669160d827bddb32639c4f54f099d4cc4cca812702fcaeaf47ef9837407c0e63a1463f5d86d52a8d1f0507a6988f0e6f1e67e4c1d982e6
SSDEEP

24576:Hy3g5Lt2xAY1/j/33YoOCkmlhbelDF/ShJdERb2IUB3kE9:Sw5LaAY1/j/naZlDlShuBU26

Score

10^/10

poullight spyware stealer trojan

Malware Config

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4824-2-0x0000000000E50000-0x00000000011D4000-memory.dmp	family_poullight

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

Processes:

3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

pid	process
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

pid process

4824 3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
4824 3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4824 3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

pid process

4824 3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4824	3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3da0cddc659c276b12782372d135f34f_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\o20uzmaqxtdn--km
Filesize
100KB

MD5
78855c87b9d2682c8141f1afe227dd1d

SHA1
8b0bf8584c49cf70bebb1b289f765532eb0cb127

SHA256
c9217d14f586d9e694446bcf76f67442b2440af2a3bce5fa593194bcd314f4e0

SHA512
cb54bb1683f31ef4f5f4766745909a48dbf61cbbff409a3a596d8b71d65a9f879c47eb479c67e58dd3a05a0049d5bdbd4215242490a9f552ad131d5ef95975b4

Download Submit
C:\Users\Admin\AppData\Local\zna1c3k3\Skype\data.txt
Filesize
55B

MD5
f42b48302a71c9b07559c714520a5691

SHA1
56961243dbdfd2663ff593367170eddd789acf53

SHA256
16c37c7a818dd689367d4c89d548338818b839bde3b2f0498dc8c854097d34a7

SHA512
a84dcda6a4f4dcf8968e123f173b4db2b2700e9ceb7787488c6d46ec2404096e59807f6878f6b6d7613cc838e5ce13be932771578a4f088ad59492eba9094504

Download Submit
memory/4824-4-0x00000000061E0000-0x0000000006272000-memory.dmp

Filesize
584KB

Download
memory/4824-2-0x0000000000E50000-0x00000000011D4000-memory.dmp

Filesize
3.5MB

Download
memory/4824-0-0x0000000000E50000-0x00000000011D4000-memory.dmp

Filesize
3.5MB

Download
memory/4824-5-0x0000000004110000-0x000000000411A000-memory.dmp

Filesize
40KB

Download
memory/4824-6-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download
memory/4824-7-0x0000000006280000-0x00000000062E6000-memory.dmp

Filesize
408KB

Download
memory/4824-9-0x00000000066C0000-0x00000000066CA000-memory.dmp

Filesize
40KB

Download
memory/4824-3-0x00000000066F0000-0x0000000006C94000-memory.dmp

Filesize
5.6MB

Download
memory/4824-29-0x00000000083A0000-0x0000000008562000-memory.dmp

Filesize
1.8MB

Download
memory/4824-32-0x0000000008AA0000-0x0000000008FCC000-memory.dmp

Filesize
5.2MB

Download
memory/4824-1-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Filesize
4KB

Download
memory/4824-45-0x0000000008320000-0x0000000008332000-memory.dmp

Filesize
72KB

Download
memory/4824-69-0x0000000000E50000-0x00000000011D4000-memory.dmp

Filesize
3.5MB

Download
memory/4824-71-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Filesize
4KB

Download
memory/4824-72-0x0000000073FA0000-0x0000000074750000-memory.dmp

Filesize
7.7MB

Download