cae6abfbe549f8e3f19f034978b196ba094c15c4aeaa8ec80d1eb741ad6d9b1d

Analysis

max time kernel
95s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-09_30f1ac0b8febbb870220e1351d8cd200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
Size

5.0MB
MD5

30f1ac0b8febbb870220e1351d8cd200
SHA1

228e13082eda9415ac9b2b4e693a5f4ef713f049
SHA256

cae6abfbe549f8e3f19f034978b196ba094c15c4aeaa8ec80d1eb741ad6d9b1d
SHA512

9c698bd9f96d1c82a86e1f910636e98b9e6f34a74198285831a88c6451cdb67e0f7e42360423d7c533288d7af37631461b3a4ba8a98636026b57ca50599bc629
SSDEEP

49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnt:r56utgpPFotBER/mQ32lUr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-09_30f1ac0b8febbb870220e1351d8cd200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-09_30f1ac0b8febbb870220e1351d8cd200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-09_30f1ac0b8febbb870220e1351d8cd200_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads