Analysis
- max time kernel
93s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240704-en - resource tags
- submitted
05/07/2024, 01:33
General
- Target 947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe
- Size 6.4MB
- Sample240705-byvrka1gmh
- SHA256 947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d
Score
10/10
Malware Config
Signatures
- Detect Poverty Stealer Payload 7 IoCs
- Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe"C:\Users\Admin\AppData\Local\Temp\947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1232-8-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1232-5-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1232-9-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1232-12-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1232-13-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1232-10-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1232-14-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/1232-15-0x00000000003B0000-0x00000000003BA000-memory.dmp
memory/4816-4-0x00007FF75EAC0000-0x00007FF75F185000-memory.dmp
memory/4816-6-0x00007FF75EAC0000-0x00007FF75F185000-memory.dmp