Analysis
-
max time kernel
93s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
09/07/2024, 04:34
General
-
Target
2024-07-09_4b5561705cff2e4589700f4b5d03eda4_poet-rat_snatch.exe
-
Size
11.7MB
-
MD5
4b5561705cff2e4589700f4b5d03eda4
-
SHA1
31e1c6b914f18eda721e4c2cf919b2016ec06250
-
SHA256
0ee951fab9f06847a308fd338377fe97154d706b01912cee86822923722997cf
-
SHA512
ff870ce29f278c3760a4cdc2ec8210949aa7b6f552f7a9315c6fcc0f54c017513cd83ae07d0e4077d159b5671385d5d29e13a73c352251d4b6627c5956cffeca
-
SSDEEP
196608:Q28/ANdDzfxujCMJ/0x9blDJeifUE7JEda1peUARlV49b:lSAvDrxujvSlDkwJDpZiw
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_4b5561705cff2e4589700f4b5d03eda4_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_4b5561705cff2e4589700f4b5d03eda4_poet-rat_snatch.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5b3110ab5802bb3aec279ac0043aeedc3
SHA17da39144f5c2ac6656c29bea43a03fdc36f07b7c
SHA2560e30d979a4a41fe42bfdb86a7163952d437bd84e477fe645d2c1a3b02b27167e
SHA5124a4dbb38143db7083bff99654e3bd032ec38cb7745a140655f5a19f6f6ff56379f445e9c946b21fb2b7c47889465350b1097e4e86e9a4dadc77418057e588133
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
11.9MB
-
Filesize
384KB
-
Filesize
11.9MB
-
Filesize
680KB
-
Filesize
680KB