2b5bce8623468a2e58c6cc817c1556dd1ef69cb184083a2d8d68a1bb78cbc2d2

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe
Size

15.0MB
MD5

31fcfe752d30c3f9cfb212a5f58568a7
SHA1

e1c2fd2db1294153fe1ffcf7fa5d40f96767bad2
SHA256

2b5bce8623468a2e58c6cc817c1556dd1ef69cb184083a2d8d68a1bb78cbc2d2
SHA512

4341b3474fdec168565f45008495c194f310995452c71d7c92aec8427031b3c0e4b9b6d1217be5386d8ce9bc9eccfd862dada7fbb0e625b946a25997e4f355d6
SSDEEP

196608:zvTCF+0B6s7Vq1QpUPZ7ubMgFKcnSJiZKi9m2gB6bIK6w3:3w+M6GVYQpUP0xnS0m2gB6bII

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
16	discord.com
17	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3284	wmic.exe
Token: SeSecurityPrivilege	3284	wmic.exe
Token: SeTakeOwnershipPrivilege	3284	wmic.exe
Token: SeLoadDriverPrivilege	3284	wmic.exe
Token: SeSystemProfilePrivilege	3284	wmic.exe
Token: SeSystemtimePrivilege	3284	wmic.exe
Token: SeProfSingleProcessPrivilege	3284	wmic.exe
Token: SeIncBasePriorityPrivilege	3284	wmic.exe
Token: SeCreatePagefilePrivilege	3284	wmic.exe
Token: SeBackupPrivilege	3284	wmic.exe
Token: SeRestorePrivilege	3284	wmic.exe
Token: SeShutdownPrivilege	3284	wmic.exe
Token: SeDebugPrivilege	3284	wmic.exe
Token: SeSystemEnvironmentPrivilege	3284	wmic.exe
Token: SeRemoteShutdownPrivilege	3284	wmic.exe
Token: SeUndockPrivilege	3284	wmic.exe
Token: SeManageVolumePrivilege	3284	wmic.exe
Token: 33	3284	wmic.exe
Token: 34	3284	wmic.exe
Token: 35	3284	wmic.exe
Token: 36	3284	wmic.exe
Token: SeIncreaseQuotaPrivilege	3284	wmic.exe
Token: SeSecurityPrivilege	3284	wmic.exe
Token: SeTakeOwnershipPrivilege	3284	wmic.exe
Token: SeLoadDriverPrivilege	3284	wmic.exe
Token: SeSystemProfilePrivilege	3284	wmic.exe
Token: SeSystemtimePrivilege	3284	wmic.exe
Token: SeProfSingleProcessPrivilege	3284	wmic.exe
Token: SeIncBasePriorityPrivilege	3284	wmic.exe
Token: SeCreatePagefilePrivilege	3284	wmic.exe
Token: SeBackupPrivilege	3284	wmic.exe
Token: SeRestorePrivilege	3284	wmic.exe
Token: SeShutdownPrivilege	3284	wmic.exe
Token: SeDebugPrivilege	3284	wmic.exe
Token: SeSystemEnvironmentPrivilege	3284	wmic.exe
Token: SeRemoteShutdownPrivilege	3284	wmic.exe
Token: SeUndockPrivilege	3284	wmic.exe
Token: SeManageVolumePrivilege	3284	wmic.exe
Token: 33	3284	wmic.exe
Token: 34	3284	wmic.exe
Token: 35	3284	wmic.exe
Token: 36	3284	wmic.exe
Token: SeIncreaseQuotaPrivilege	3928	wmic.exe
Token: SeSecurityPrivilege	3928	wmic.exe
Token: SeTakeOwnershipPrivilege	3928	wmic.exe
Token: SeLoadDriverPrivilege	3928	wmic.exe
Token: SeSystemProfilePrivilege	3928	wmic.exe
Token: SeSystemtimePrivilege	3928	wmic.exe
Token: SeProfSingleProcessPrivilege	3928	wmic.exe
Token: SeIncBasePriorityPrivilege	3928	wmic.exe
Token: SeCreatePagefilePrivilege	3928	wmic.exe
Token: SeBackupPrivilege	3928	wmic.exe
Token: SeRestorePrivilege	3928	wmic.exe
Token: SeShutdownPrivilege	3928	wmic.exe
Token: SeDebugPrivilege	3928	wmic.exe
Token: SeSystemEnvironmentPrivilege	3928	wmic.exe
Token: SeRemoteShutdownPrivilege	3928	wmic.exe
Token: SeUndockPrivilege	3928	wmic.exe
Token: SeManageVolumePrivilege	3928	wmic.exe
Token: 33	3928	wmic.exe
Token: 34	3928	wmic.exe
Token: 35	3928	wmic.exe
Token: 36	3928	wmic.exe
Token: SeIncreaseQuotaPrivilege	3928	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3284	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	85
PID 4036 wrote to memory of 3284	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	85
PID 4036 wrote to memory of 3928	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	87
PID 4036 wrote to memory of 3928	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	87
PID 4036 wrote to memory of 4432	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	89
PID 4036 wrote to memory of 4432	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	89
PID 4036 wrote to memory of 3576	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	90
PID 4036 wrote to memory of 3576	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	90
PID 4036 wrote to memory of 4400	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	92
PID 4036 wrote to memory of 4400	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	92
PID 4036 wrote to memory of 3444	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	93
PID 4036 wrote to memory of 3444	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	93
PID 4036 wrote to memory of 4736	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	94
PID 4036 wrote to memory of 4736	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	94
PID 4036 wrote to memory of 4132	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	95
PID 4036 wrote to memory of 4132	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	95
PID 4036 wrote to memory of 4512	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	96
PID 4036 wrote to memory of 4512	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	96
PID 4036 wrote to memory of 2208	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	97
PID 4036 wrote to memory of 2208	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	97
PID 4036 wrote to memory of 2776	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	98
PID 4036 wrote to memory of 2776	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	98
PID 4036 wrote to memory of 3624	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	99
PID 4036 wrote to memory of 3624	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	99
PID 4036 wrote to memory of 1312	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	100
PID 4036 wrote to memory of 1312	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	100
PID 4036 wrote to memory of 2484	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	101
PID 4036 wrote to memory of 2484	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	101
PID 4036 wrote to memory of 3604	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	102
PID 4036 wrote to memory of 3604	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	102
PID 4036 wrote to memory of 3728	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	103
PID 4036 wrote to memory of 3728	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	103
PID 4036 wrote to memory of 4668	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	104
PID 4036 wrote to memory of 4668	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	104
PID 4036 wrote to memory of 3244	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	105
PID 4036 wrote to memory of 3244	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	105
PID 4036 wrote to memory of 5104	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	106
PID 4036 wrote to memory of 5104	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	106
PID 4036 wrote to memory of 184	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	107
PID 4036 wrote to memory of 184	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	107
PID 4036 wrote to memory of 3608	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	108
PID 4036 wrote to memory of 3608	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	108
PID 4036 wrote to memory of 4760	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	109
PID 4036 wrote to memory of 4760	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	109
PID 4036 wrote to memory of 4088	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	110
PID 4036 wrote to memory of 4088	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	110
PID 4036 wrote to memory of 3332	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	111
PID 4036 wrote to memory of 3332	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	111
PID 4036 wrote to memory of 2656	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	112
PID 4036 wrote to memory of 2656	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	112
PID 4036 wrote to memory of 1628	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	113
PID 4036 wrote to memory of 1628	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	113
PID 4036 wrote to memory of 1836	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	114
PID 4036 wrote to memory of 1836	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	114
PID 4036 wrote to memory of 448	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	115
PID 4036 wrote to memory of 448	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	115
PID 4036 wrote to memory of 3024	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	116
PID 4036 wrote to memory of 3024	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	116
PID 4036 wrote to memory of 2000	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	117
PID 4036 wrote to memory of 2000	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	117
PID 4036 wrote to memory of 2356	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	118
PID 4036 wrote to memory of 2356	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	118
PID 4036 wrote to memory of 3348	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	119
PID 4036 wrote to memory of 3348	4036	2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe	119

C:\Users\Admin\AppData\Local\Temp\2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-10_31fcfe752d30c3f9cfb212a5f58568a7_poet-rat_snatch.exe"
1⤵
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3284
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4432
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3576
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4400
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3444
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4736
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4132
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4512
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2208
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2776
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3624
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1312
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2484
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3604
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3728
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4668
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3244
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:5104
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:184
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3608
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4760
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4088
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3332
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2656
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1628
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1836
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:448
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3024
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2000
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2356
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3348
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1908
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1984
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4860
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3040
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4076
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1724
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4724
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2012
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4364
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4720
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3284
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3344
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3396
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1120
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2808
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3820
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4964
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3688
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4352
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:452
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4808
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3636
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1332
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1204
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3888
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2704
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3896
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1652
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2376
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:464
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:348
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:852
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4596
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4252
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3332
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2656
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1628
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3944
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3492
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4060
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4800
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4016
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2268
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3960
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1676
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2392
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1404
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1984
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4860
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2836
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1072
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4356
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4724
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2728
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3452
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3948
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:3284
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4080
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2424
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2388
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4664
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:760
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:2104
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:1136
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get uuid
  2⤵
  PID:4132