povertystealer | 947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 18:04

Target

947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe
Size

6.4MB
MD5

1f4e76e35124c2fa6c41a96a30f6124a
SHA1

843de82efbd8d17d96733251ce723540a2c05e59
SHA256

947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d
SHA512

2151d0ea0dc0072797ac62aeee36063c73bf8fae7fb8c0c21729f5afb08a4d2cdd4e357d6f2f4abccb815d1a4c855e3a7ad8a025fbdd4c6c3e27e7310cb728ec
SSDEEP

49152:0p0oLdmIlD/YsO/HessCMuFSYQSMN5vAjU4qfguFaWGS4NUBT+L12jO5E4hIIBWw:vEdmIlDqHeKFdPj5qfoLfEz6L/

Score

10^/10

Detect Poverty Stealer Payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3104-4-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer
behavioral2/memory/3104-7-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer
behavioral2/memory/3104-8-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer
behavioral2/memory/3104-9-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer
behavioral2/memory/3104-11-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer
behavioral2/memory/3104-13-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer
behavioral2/memory/3104-14-0x00000000005D0000-0x00000000005DA000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe

description	pid	process	target process
PID 1336 set thread context of 3104	1336	947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe	BitLockerToGo.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe

description	pid	process	target process
PID 1336 wrote to memory of 3104	1336	947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe	BitLockerToGo.exe
PID 1336 wrote to memory of 3104	1336	947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe	BitLockerToGo.exe
PID 1336 wrote to memory of 3104	1336	947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe	BitLockerToGo.exe
PID 1336 wrote to memory of 3104	1336	947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe	BitLockerToGo.exe
PID 1336 wrote to memory of 3104	1336	947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe
"C:\Users\Admin\AppData\Local\Temp\947ef875bd33912333be6b33291752cfc2c29393adbaa5ce78cdfa0b3aefc75d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
  2⤵
  PID:3104

memory/1336-5-0x00007FF622F50000-0x00007FF623615000-memory.dmp

Filesize
6.8MB

Download
memory/3104-4-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-7-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-8-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-9-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-11-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-12-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/3104-13-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-14-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/3104-15-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download