f06d0f702c63deb3a0a86defa6730b5886522872f8bc6ad565a665c83f76b6ae

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-23_5470a4ef9f9a778dff7a1376912ddd8f_poet-rat_snatch.exe
Size

16.0MB
MD5

5470a4ef9f9a778dff7a1376912ddd8f
SHA1

42ce6e45adbea85a114bc670b8484a853cfa4c63
SHA256

f06d0f702c63deb3a0a86defa6730b5886522872f8bc6ad565a665c83f76b6ae
SHA512

5f26b7e7d3fe4fbf034530fefd55154db6e8b4eb5e37f28a28001deff0e22e3381653c6079069594a19190d3097a1612741757456bef0953a61435d351a22bf1
SSDEEP

98304:WzOkboRQnw5MIdDo4bbCJq4jR81b4er6/H6q2w79/+wrBAgO+2mAKmYs6M:RO3UD5b0R81bXrG92w79meBA9Nmll

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-23_5470a4ef9f9a778dff7a1376912ddd8f_poet-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-23_5470a4ef9f9a778dff7a1376912ddd8f_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-23_5470a4ef9f9a778dff7a1376912ddd8f_poet-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...