6dfe159d6d98aa77d2dd48faa6d8551590c2d03bc14136ffc993690fad1cf8ae

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:54

Target

2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
Size

27.8MB
MD5

aa195640c67b7ac088f5afc151211469
SHA1

f8096c7375a4af1b72f60875429408165970f1ae
SHA256

6dfe159d6d98aa77d2dd48faa6d8551590c2d03bc14136ffc993690fad1cf8ae
SHA512

696bb75728943c0f1b0fb178e18fd032c32abf938b27a6fe11b00351cc860d4f9b70fde05fed3fd3d281967c8afad3bc5e30f0f28945634733f16a86757e18fc
SSDEEP

98304:iwe+bw6pfcusWXHDSk7lVB0PThRI9Q0pN5fnI69hEZgvxIpX8+V0nxcCFZvqVlAA:iwl7UusWXjXVX2Zx8fFJSz

Score

1^/10

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
2924	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
2924	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
2924	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
2924	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 2924	3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe	83
PID 3748 wrote to memory of 2924	3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe	83
PID 3748 wrote to memory of 3700	3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe	84
PID 3748 wrote to memory of 3700	3748	2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
  C:\Users\Admin\AppData\Local\Temp\2024-09-19_aa195640c67b7ac088f5afc151211469_hijackloader_poet-rat_snatch.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- C:\Windows\system32\cmd.exe
  cmd.exe /K
  2⤵
  PID:3700