b3442b1c454ba1dc74194f42a1b30ab79a110e91aa85f1a06d7f5520f7fd161b

General

Target

2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe
Size

14.1MB
MD5

1a206c1f40e8126f0dd8b6bffb8a748b
SHA1

94cee0cf25c95e6abd942fffb2127e9ae46cb993
SHA256

b3442b1c454ba1dc74194f42a1b30ab79a110e91aa85f1a06d7f5520f7fd161b
SHA512

94f7e2ee1c9cad0233d21bef0c69abf659e4696202effe568d45d82a87a33cfc214b02be329073b8b26d60746f2d6c7fd8848ed8bd1319100555ab9e2edd8b37
SSDEEP

196608:czKBNAf9jWvQfClOs11G43eJexAZT0O8L:7rAJ5eePZo

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2772	icacls.exe
1364	icacls.exe
2568	icacls.exe
3016	icacls.exe
2860	icacls.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	2772	icacls.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2860	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	31
PID 3020 wrote to memory of 2860	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	31
PID 3020 wrote to memory of 2860	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	31
PID 3020 wrote to memory of 2860	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	31
PID 3020 wrote to memory of 2772	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	32
PID 3020 wrote to memory of 2772	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	32
PID 3020 wrote to memory of 2772	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	32
PID 3020 wrote to memory of 2772	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	32
PID 3020 wrote to memory of 1364	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	33
PID 3020 wrote to memory of 1364	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	33
PID 3020 wrote to memory of 1364	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	33
PID 3020 wrote to memory of 1364	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	33
PID 3020 wrote to memory of 2568	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	34
PID 3020 wrote to memory of 2568	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	34
PID 3020 wrote to memory of 2568	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	34
PID 3020 wrote to memory of 2568	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	34
PID 3020 wrote to memory of 3016	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	35
PID 3020 wrote to memory of 3016	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	35
PID 3020 wrote to memory of 3016	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	35
PID 3020 wrote to memory of 3016	3020	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	35

C:\Users\Admin\AppData\Local\Temp\2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /reset /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2860
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /setowner SYSTEM /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /grant users:(RC,GR,RD,REA,X,RA) /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /grant SYSTEM:F /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:2568
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /inheritance:r
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Droplet\keepalive.exe

Filesize
2.8MB

MD5
a04a3b3d2b45d8e750414ab6855a29c4

SHA1
03c4d4ac791f922d546e8561306aec62eb1a116a

SHA256
ec261c8bbbd2513fc4c75172ca20273ecf57334d603630b7067164a113f7c386

SHA512
4dec2b6a25027b7f014aeffd5e4a5934b147e674571976f8fba9d0fa3aca934a7d5937f1840e35583d69eb69a2e1e5f4e8d110f57d899c89d7d0b4a696d5b146

Download Submit
C:\Droplet\logs\daemon-info.log

Filesize
793B

MD5
6251c4d6cc868ae2507be6e2cbc06ae5

SHA1
921a9051e47679fafa2442fe0885ab11e134ca31

SHA256
7573eb58beb778c7d1ef2559bf2f4cb3edfe785a7a275900282144a17b86ada5

SHA512
415ef5ccf230ec6164f825321debb84d04354c168f303e0ab35bab3e58d75e041e0cfe3c868060f775e83b8b4e2dd83c4042de106c27bc01740e98c4c96e052b

Download Submit
C:\Droplet\updater.exe

Filesize
2.5MB

MD5
7ba8ad2358afdf2fef7e631228836315

SHA1
3f0fd3615e12bf06270876b7d0a91f416006aedb

SHA256
7422b46a93f0d8c7e8cdf4efdcdfba2d3e2cc4cdb3fb8236de9f0ea55f2e912d

SHA512
efa529516e7dd69e11cf996b0bad1849a207e721221bf2fce0490bd772224a810a2afa259cf4aae116891ec661261f834bb2ab9ba83297d2d90e31153638b4d3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads