984980faf0932b1ea9b25368f5def92c00a31633bb26042f32be442814a9cdcd

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-10_3a22d70833f6b956c5440af8a3a0ef9e_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
Size

5.0MB
MD5

3a22d70833f6b956c5440af8a3a0ef9e
SHA1

e08331d2eed4def9333f8ef20e367d6a2b4751c6
SHA256

984980faf0932b1ea9b25368f5def92c00a31633bb26042f32be442814a9cdcd
SHA512

59d2db5567dac566c42ac10dea6dc5aa5fa72c89ae829e318313f94eb3553f00b518da5fb058d1f8f0b2694b962dddd5c179e4e3c0f5c07664f10fec60d39cce
SSDEEP

49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnw:r56utgpPFotBER/mQ32lUa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-10_3a22d70833f6b956c5440af8a3a0ef9e_cobalt-strike_cobaltstrike_poet-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-09-10_3a22d70833f6b956c5440af8a3a0ef9e_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-10_3a22d70833f6b956c5440af8a3a0ef9e_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads