Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
06-07-2024 15:30
General
-
Target
2024-07-06_cae25b2e9a4f9e5ed5705a22fbaa83d2_poet-rat_snatch.exe
-
Size
19.2MB
-
MD5
cae25b2e9a4f9e5ed5705a22fbaa83d2
-
SHA1
59864e4faf0b3077f702e56926917193bd81e92a
-
SHA256
2b0d106769e31de3257b21fa88d7dc80819ade9b8eed16a2a079ecf745180e15
-
SHA512
5614f3658c45cf8159e01bb4702dd2904a534a1346519130a65ed760f58aeb961cb307447945e0a34f9e40d579d80f757ebbe5abbe344d2d232355b2f5129674
-
SSDEEP
393216:GOynShfZEczqfv4y+BadD3Vmf7Grx9J1L:GOyn4zqX+BaBY7Grx9rL
Score
10/10
Malware Config
Signatures
-
Sliver RAT v2 4 IoCs
-
SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_cae25b2e9a4f9e5ed5705a22fbaa83d2_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_cae25b2e9a4f9e5ed5705a22fbaa83d2_poet-rat_snatch.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4208,i,7362247189940554640,1583793531684159627,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
10.9MB