cd1521f63f03a9ed02def4f85faad4929a19eb18319d75a55e9f68f6ef674903

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:48

Target

2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
Size

27.8MB
MD5

4855266dc0c1c5c274f3ed44686c6e30
SHA1

5460aa5b305a80491784ce7d72b85a144e59f09d
SHA256

cd1521f63f03a9ed02def4f85faad4929a19eb18319d75a55e9f68f6ef674903
SHA512

de008f33859a6b03bb6c1bab5b8a1559bfabe8d1b9d55570b895434a092fc57e2d8b9c918cd5500aec2ccf83ecd28f1ad10c3d768e08665bc79f115a0cd84a83
SSDEEP

98304:iwe+bw6pfcusWXHDSk7lVB0PThRI9Q0pN5fnI69hEZgvxIpX8+V0nxcCFZvqVlAV:iwl7UusWXjXVX2Zx8fFJSI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
3200	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
3200	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
3200	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
3200	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3200	5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe	83
PID 5024 wrote to memory of 3200	5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe	83
PID 5024 wrote to memory of 872	5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe	84
PID 5024 wrote to memory of 872	5024	2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2024-09-19_4855266dc0c1c5c274f3ed44686c6e30_hijackloader_poet-rat_snatch.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Windows\system32\cmd.exe
  cmd.exe /K
  2⤵
  PID:872