be7644cecc2a38c7e940eac967a4f1874975044605c9435c91cc72a2f6da8373 | Triage

Sharing

General

Target

2024-08-18_0cb1cd96a9040375ccb2bf55b7cbf016_poet-rat_snatch
Size

7.9MB
Sample

240818-tt7vfavhmn
MD5

0cb1cd96a9040375ccb2bf55b7cbf016
SHA1

7390264e8d9565db41d11c030a5534ada49fc96a
SHA256

be7644cecc2a38c7e940eac967a4f1874975044605c9435c91cc72a2f6da8373
SHA512

00c2fb996b8b24cd16fb045ee41822c5c493b290a31b0a1f938654a6f09c36f5d6db00d6432b4bbb8978e8c3599097eb4985b2548cad1f81aace99055c2e0b52
SSDEEP

98304:SLBrws1ai4FNIfEKhjwwnVigX6vMpfoh4AA31WVKcBQH:SOs1ai4NKh/VBQM9oVPIcG

Score

10^/10

discovery persistence

Malware Config

Targets

- Target
  
  2024-08-18_0cb1cd96a9040375ccb2bf55b7cbf016_poet-rat_snatch
- Size
  
  7.9MB
- MD5
  
  0cb1cd96a9040375ccb2bf55b7cbf016
- SHA1
  
  7390264e8d9565db41d11c030a5534ada49fc96a
- SHA256
  
  be7644cecc2a38c7e940eac967a4f1874975044605c9435c91cc72a2f6da8373
- SHA512
  
  00c2fb996b8b24cd16fb045ee41822c5c493b290a31b0a1f938654a6f09c36f5d6db00d6432b4bbb8978e8c3599097eb4985b2548cad1f81aace99055c2e0b52
- SSDEEP
  
  98304:SLBrws1ai4FNIfEKhjwwnVigX6vMpfoh4AA31WVKcBQH:SOs1ai4NKh/VBQM9oVPIcG
Score

10^/10

discovery persistence
- Modifies WinLogon for persistence
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistence