povertystealer | 33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5

General

Target
33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe
Size 38KB
Sample240816-n7dkvstblf
SHA256 33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5
MD5 034760de34699714e37a1b98c845b750
SHA1 8bdf05b7d765a84d2bc99623cc8a12532250a7f5
SHA512 e26a5a7dc98c0549317a144b926f2b81f15b62e51dd38c28337d1be8f1b2f9f461660186676e4ab1b398f56c24db7d6a17eebb734664ffc4177d8ac433815d98
SSDEEP 768:cYaeF8BSuQHSr6bISm1tD8KOdhlx5uAIbKNNXq20y8iD:RxTuglISatD8FDlx5u5aNX18O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect Poverty Stealer Payload 7 IoCs

resource	yara_rule
behavioral2/memory/2612-4-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2612-8-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2612-10-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2612-11-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2612-14-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2612-15-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer
behavioral2/memory/2612-16-0x0000000000400000-0x000000000040A000-memory.dmp	family_povertystealer

Poverty Stealer
Poverty Stealer is a crypto and infostealer written in C++.
stealer povertystealer
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5348 set thread context of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79
PID 5348 wrote to memory of 2612	5348	33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe	79

C:\Users\Admin\AppData\Local\Temp\33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe
"C:\Users\Admin\AppData\Local\Temp\33dc6f89d505ad4b2df91ba98bff96bb2767e12eac2ba716246615c83dffbde5.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2612