Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 02:24

General

  • Target

    2024-08-24_91af9a6c806b7ab834eb3cdb5f241024_poet-rat_snatch.exe

  • Size

    5.8MB

  • MD5

    91af9a6c806b7ab834eb3cdb5f241024

  • SHA1

    4073f447b6dbdfd6a770a2dc3a025f1351487462

  • SHA256

    a650b92b1bc747877f088971b432d5e27570935f1bd2938c22e521684eae80ee

  • SHA512

    b503ec643291cff5f0350e29ac6bcfbac7ae41ac1a9c77541e6c8120af492851beab5640c90b984ba586c9023d69738c88b8b8e6ff1bcc5f35a5b8c7e7b9d041

  • SSDEEP

    49152:vzlnEcO3Cgrb/TbvO90d7HjmAFd4A64nsfJa/pJMBMvDF/4q4auspdkgKKhdvZf7:63CE/Xx4LKhdkKESp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-24_91af9a6c806b7ab834eb3cdb5f241024_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-24_91af9a6c806b7ab834eb3cdb5f241024_poet-rat_snatch.exe"
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\system32\schtasks.exe
      C:\Windows\system32\schtasks.exe /CREATE /XML C:\Users\Admin\AppData\Local\Temp\UUUEEumMAJr /F /TN ChromeUpdateTaskMachinCore
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2644
    • C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe
        "C:\Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab2889.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar289B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\UUUEEumMAJr

    Filesize

    1KB

    MD5

    1cf938c0260965a42afda2f66ba7e5d6

    SHA1

    130417749d98cc4c0698477a6fe7c20e80646610

    SHA256

    3930b80d5c0e982b80eb71d4d782f894b1d5051888c8cafedbf47a5d80fbd853

    SHA512

    cc215a2bda5e8fd9649071f9632669cb4e589c8161e84c12113a6baa32ed35db402ce60263b4534dd0d10149e8d5de9fc7766c0cb06332ddebbc4b7cb634cb32

  • \Program Files\ChromeUpdateTaskMachinCore\ChromeUpdateTaskMachinCore.exe

    Filesize

    5.8MB

    MD5

    b14cb5e20884b9d738c696cf2e372150

    SHA1

    057c996b36272978813ffea8e0d10d9f87138660

    SHA256

    f720cee2af0c4c721eaef3916f131a0107e956c0f9a3b4dc83be2015d0027e87

    SHA512

    7ca9f99a687f65ccc89da6fcc0ace808ea94c28e8f8b7c145281e65f552ef09fd47a453bc877747807bd7fa71e8fe8aca5340e00c6d3072816b0e0476b520742