General
-
Target
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch
-
Size
9.5MB
-
Sample
240730-artp9aycqk
-
MD5
3cf1e06121b623d2a8aa1b87317f2862
-
SHA1
a328d0b8f5fddb5329120a42c8b4d8d454df0cc7
-
SHA256
6a84fa6d9ada7d92608a8151e717bffcc2e10a076f6b49786475f810391d92e9
-
SHA512
6b406234e4bdd1364e7255de3483cb14b556fa0dcd1e84d0f2151b4dffda4c259d25aa2267aab80a781e46c4ca967634e5a335b07933cee04fb3977ee9fc8c32
-
SSDEEP
98304:QStuP4FfFJpqQvLmaYocohCn+ziEhW7F/82HIP:5EMfFvZYocoYn+zvhQHIP
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1267254147871412244/mw3axCfBQQXK_ENvEh48DrzPLTmIcxCeHKBLTmzDTtWSrCuuPad1GmQz-Pd1TOPRUnu9
Targets
-
-
Target
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch
-
Size
9.5MB
-
MD5
3cf1e06121b623d2a8aa1b87317f2862
-
SHA1
a328d0b8f5fddb5329120a42c8b4d8d454df0cc7
-
SHA256
6a84fa6d9ada7d92608a8151e717bffcc2e10a076f6b49786475f810391d92e9
-
SHA512
6b406234e4bdd1364e7255de3483cb14b556fa0dcd1e84d0f2151b4dffda4c259d25aa2267aab80a781e46c4ca967634e5a335b07933cee04fb3977ee9fc8c32
-
SSDEEP
98304:QStuP4FfFJpqQvLmaYocohCn+ziEhW7F/82HIP:5EMfFvZYocoYn+zvhQHIP
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4