b3442b1c454ba1dc74194f42a1b30ab79a110e91aa85f1a06d7f5520f7fd161b

General

Target

2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe
Size

14.1MB
MD5

1a206c1f40e8126f0dd8b6bffb8a748b
SHA1

94cee0cf25c95e6abd942fffb2127e9ae46cb993
SHA256

b3442b1c454ba1dc74194f42a1b30ab79a110e91aa85f1a06d7f5520f7fd161b
SHA512

94f7e2ee1c9cad0233d21bef0c69abf659e4696202effe568d45d82a87a33cfc214b02be329073b8b26d60746f2d6c7fd8848ed8bd1319100555ab9e2edd8b37
SSDEEP

196608:czKBNAf9jWvQfClOs11G43eJexAZT0O8L:7rAJ5eePZo

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
820	icacls.exe
5060	icacls.exe
3732	icacls.exe
1664	icacls.exe
4344	icacls.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	5060	icacls.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 820	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	86
PID 1644 wrote to memory of 820	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	86
PID 1644 wrote to memory of 820	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	86
PID 1644 wrote to memory of 5060	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	87
PID 1644 wrote to memory of 5060	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	87
PID 1644 wrote to memory of 5060	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	87
PID 1644 wrote to memory of 3732	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	88
PID 1644 wrote to memory of 3732	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	88
PID 1644 wrote to memory of 3732	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	88
PID 1644 wrote to memory of 1664	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	90
PID 1644 wrote to memory of 1664	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	90
PID 1644 wrote to memory of 1664	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	90
PID 1644 wrote to memory of 4344	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	91
PID 1644 wrote to memory of 4344	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	91
PID 1644 wrote to memory of 4344	1644	2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_1a206c1f40e8126f0dd8b6bffb8a748b_poet-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /reset /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:820
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /setowner SYSTEM /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /grant users:(RC,GR,RD,REA,X,RA) /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /grant SYSTEM:F /t
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1664
- C:\Windows\SysWOW64\icacls.exe
  icacls C:\Droplet /inheritance:r
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Droplet\keepalive.exe

Filesize
2.8MB

MD5
a04a3b3d2b45d8e750414ab6855a29c4

SHA1
03c4d4ac791f922d546e8561306aec62eb1a116a

SHA256
ec261c8bbbd2513fc4c75172ca20273ecf57334d603630b7067164a113f7c386

SHA512
4dec2b6a25027b7f014aeffd5e4a5934b147e674571976f8fba9d0fa3aca934a7d5937f1840e35583d69eb69a2e1e5f4e8d110f57d899c89d7d0b4a696d5b146

Download Submit
C:\Droplet\logs\daemon-info.log

Filesize
793B

MD5
ac55e515b566ea028bcb21a49f00cdd4

SHA1
4ce76253c5bf9f28f408786b92e3414b2214415b

SHA256
538ef468320c15b9f6dc58da51b2a6c80056d6a7fab680955ebffbf8a5e0b435

SHA512
beddc5e9e93c87a0341940384532638f7d469be3690efe5905884e3c3c4dae5d1d8bdde5a3c18abe032b7012eef6f0207b3d087f7f046571055f5288508025eb

Download Submit
C:\Droplet\updater.exe

Filesize
2.5MB

MD5
7ba8ad2358afdf2fef7e631228836315

SHA1
3f0fd3615e12bf06270876b7d0a91f416006aedb

SHA256
7422b46a93f0d8c7e8cdf4efdcdfba2d3e2cc4cdb3fb8236de9f0ea55f2e912d

SHA512
efa529516e7dd69e11cf996b0bad1849a207e721221bf2fce0490bd772224a810a2afa259cf4aae116891ec661261f834bb2ab9ba83297d2d90e31153638b4d3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads