2d822b5d48100ac6fc83f1817388f00dfcb3501dd8486caf802a031c97d3a763 | Triage

Sharing

General

Target

2024-09-14_0046c35e3ac89f8f076e7408935d080e_poet-rat_snatch
Size

21.0MB
Sample

240914-mes96syfnj
MD5

0046c35e3ac89f8f076e7408935d080e
SHA1

0f1d6bacd93659a318a480055846e2383084676c
SHA256

2d822b5d48100ac6fc83f1817388f00dfcb3501dd8486caf802a031c97d3a763
SHA512

e5f9c9a8af75b8ce0830955457a362ae270f9b2ed80119dbda63e2bf0c1d3555b07e024e8d8a42b35f5b762b300de18707cdbeafd7acc87f9499af694108a7da
SSDEEP

196608:ny8/640qQt8T1iiNv67gnZ1fijdiT64CcVOabwd2f:y8/645QyJ6EPYK1VtO2f

Score

8^/10

discovery execution persistence

Malware Config

Targets

- Target
  
  2024-09-14_0046c35e3ac89f8f076e7408935d080e_poet-rat_snatch
- Size
  
  21.0MB
- MD5
  
  0046c35e3ac89f8f076e7408935d080e
- SHA1
  
  0f1d6bacd93659a318a480055846e2383084676c
- SHA256
  
  2d822b5d48100ac6fc83f1817388f00dfcb3501dd8486caf802a031c97d3a763
- SHA512
  
  e5f9c9a8af75b8ce0830955457a362ae270f9b2ed80119dbda63e2bf0c1d3555b07e024e8d8a42b35f5b762b300de18707cdbeafd7acc87f9499af694108a7da
- SSDEEP
  
  196608:ny8/640qQt8T1iiNv67gnZ1fijdiT64CcVOabwd2f:y8/645QyJ6EPYK1VtO2f
Score

8^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Creates new service(s)
  persistence execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecutionpersistence