e294e4fc31d16e1c8bd408a192ed27ef2deea2fc260459742d7706ea0f5bf3d4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe
Size

7.5MB
MD5

2056a86d60a8a433a006c453685c19a9
SHA1

24a71653525eabf6ec8ece453cdab580e0003599
SHA256

e294e4fc31d16e1c8bd408a192ed27ef2deea2fc260459742d7706ea0f5bf3d4
SHA512

3fd32638d861c45da0661c6b0ad8670be31eec9b64e9fa7acc000ad4c66689671ca2d63c9c7248478fd63d659cda054c67b7b52efdfeb1f1fd6275b82c487b8b
SSDEEP

98304:FYZDQotQHTVLk9GEycPkU/KrmtI0SHE1VKl5ZLa0quiX0Ue:FY6omTHUkUikXTOK/ujf

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b00000001228a-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b00000001228a-1.dat	upx
behavioral1/memory/1680-3-0x0000000010000000-0x0000000010033000-memory.dmp	upx
behavioral1/memory/1680-6-0x0000000010000000-0x0000000010033000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3044	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	29
PID 1680 wrote to memory of 3044	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	29
PID 1680 wrote to memory of 3044	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	29
PID 1680 wrote to memory of 3044	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	29
PID 1680 wrote to memory of 1712	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	30
PID 1680 wrote to memory of 1712	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	30
PID 1680 wrote to memory of 1712	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	30
PID 1680 wrote to memory of 1712	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	30
PID 1680 wrote to memory of 2808	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	31
PID 1680 wrote to memory of 2808	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	31
PID 1680 wrote to memory of 2808	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	31
PID 1680 wrote to memory of 2808	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	31
PID 1680 wrote to memory of 2612	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	32
PID 1680 wrote to memory of 2612	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	32
PID 1680 wrote to memory of 2612	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	32
PID 1680 wrote to memory of 2612	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	32
PID 1680 wrote to memory of 2020	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	33
PID 1680 wrote to memory of 2020	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	33
PID 1680 wrote to memory of 2020	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	33
PID 1680 wrote to memory of 2020	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	33
PID 1680 wrote to memory of 2128	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	34
PID 1680 wrote to memory of 2128	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	34
PID 1680 wrote to memory of 2128	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	34
PID 1680 wrote to memory of 2128	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	34
PID 1680 wrote to memory of 2660	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	35
PID 1680 wrote to memory of 2660	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	35
PID 1680 wrote to memory of 2660	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	35
PID 1680 wrote to memory of 2660	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	35
PID 1680 wrote to memory of 2668	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	36
PID 1680 wrote to memory of 2668	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	36
PID 1680 wrote to memory of 2668	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	36
PID 1680 wrote to memory of 2668	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	36
PID 1680 wrote to memory of 2708	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	37
PID 1680 wrote to memory of 2708	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	37
PID 1680 wrote to memory of 2708	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	37
PID 1680 wrote to memory of 2708	1680	2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe	37

C:\Users\Admin\AppData\Local\Temp\2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-29_2056a86d60a8a433a006c453685c19a9_floxif_poet-rat_snatch.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\arp.exe
  arp -a
  2⤵
  PID:3044
- C:\Windows\SysWOW64\arp.exe
  arp -s 10.127.0.1 87-ca-bd-5c-7c-1e
  2⤵
  PID:1712
- C:\Windows\SysWOW64\arp.exe
  arp -s 10.127.255.255 a9-cf-96-9d-e0-51
  2⤵
  PID:2808
- C:\Windows\SysWOW64\arp.exe
  arp -s 136.243.76.21 a8-d5-e4-57-03-be
  2⤵
  PID:2612
- C:\Windows\SysWOW64\arp.exe
  arp -s 224.0.0.22 29-c8-a2-1d-d8-ec
  2⤵
  PID:2020
- C:\Windows\SysWOW64\arp.exe
  arp -s 224.0.0.251 af-4e-fd-4e-54-bb
  2⤵
  PID:2128
- C:\Windows\SysWOW64\arp.exe
  arp -s 224.0.0.252 e0-32-b1-c7-5e-40
  2⤵
  PID:2660
- C:\Windows\SysWOW64\arp.exe
  arp -s 239.255.255.250 c9-76-83-3e-2c-7b
  2⤵
  PID:2668
- C:\Windows\SysWOW64\arp.exe
  arp -s 255.255.255.255 6d-a7-4c-12-da-fa
  2⤵
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\Common Files\System\symsrv.dll

Filesize
71KB

MD5
4fcd7574537cebec8e75b4e646996643

SHA1
efa59bb9050fb656b90d5d40c942fb2a304f2a8b

SHA256
8ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d

SHA512
7f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e

Download Submit
memory/1680-3-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1680-6-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download