Analysis

  • max time kernel
    93s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2024, 16:10

General

  • Target

    2024-09-23_be19817a502d58efb565f61591cd5aab_cobalt-strike_poet-rat_snatch.exe

  • Size

    22.4MB

  • MD5

    be19817a502d58efb565f61591cd5aab

  • SHA1

    2724dd77fe76d9757a41867589d538e0d553336e

  • SHA256

    4fb369ab0a11c70be0d8861c2483623a1e0f91ca62445985d64b3fe6b37349a1

  • SHA512

    9fafbbf5f4983b2b59b9413257b83239e329cc0d84e8ec6bce9f817eb5251352640d4aa91522d6367c60036a7bbd33bcb0e7d12c74bbb4b17aff70c0fabba4b4

  • SSDEEP

    393216:Io2QxYD1/gzQnSegNPCQM2/psErTmlJhjePxnIOLDFee:R2p4zQnSxJCQHscmNePxnv8e

Malware Config

Signatures

  • An open source browser data exporter written in golang. 9 IoCs
  • HackBrowserData

    An open source golang web browser extractor.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-23_be19817a502d58efb565f61591cd5aab_cobalt-strike_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-23_be19817a502d58efb565f61591cd5aab_cobalt-strike_poet-rat_snatch.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\script_cookie_encrypted.exe
      C:\Users\Admin\script_cookie_encrypted.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
        3⤵
          PID:3752
      • C:\Users\Admin\rate.exe
        C:\Users\Admin\rate.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
          3⤵
            PID:4904
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4076
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
            3⤵
              PID:512

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.5

          Filesize

          16B

          MD5

          9f36605efba98dab15728fe8b5538aa0

          SHA1

          6a7cff514ae159a59b70f27dde52a3a5dd01b1c8

          SHA256

          9c283f6e81028b9eb0760d918ee4bc0aa256ed3b926393c1734c760c4bd724fd

          SHA512

          1893aa3d1abcf7f9e83911468fa2eeb2ad1d7e23f4586bd6c4d76f9f96a645c15e63e44da55700347165e97b6ac412e6d495b81c3da9faa61d617c7a71a7404c

        • C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001

          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        • C:\Users\Admin\rate.exe

          Filesize

          3.6MB

          MD5

          0c8bc5317e4b23f1e6dd3a2b7af70255

          SHA1

          49dd70a5dfb41a77806f0abb0b9f54d0cd01d652

          SHA256

          af847306fa5457d15f4d378e2622f6ff3f92c9a093810f760bf1f3cc91aacb7f

          SHA512

          e95a567a70df88ac1226fd4973a6103f195c38f1790750047feead51b186434d88ab5a525c77cbe509f6fa8d8c90b77fac9daf2a48d31f85db12ab1b11863878

        • C:\Users\Admin\results\chrome_default_extension.csv

          Filesize

          302B

          MD5

          81b496ce1578a88f74dcf1b5a09f98b5

          SHA1

          ec5b2723bf4f88d001069fccd5300096c5955d0b

          SHA256

          5c99c6eb19efecfdcb5da9e8e547ce78065d0de4e7dcc4b70166d03d0870b7d5

          SHA512

          b72794dfb6955f8a2c102d072cd650617d08ca94805c791e4549ec2b326b8b896d872f848f701ebbad46342da6df051a3799af5434092b167a233a23978e580f

        • C:\Users\Admin\results\chrome_default_sessionstorage.csv

          Filesize

          34B

          MD5

          d07886f7107c50304e1b9cde0793ed04

          SHA1

          41453a6e9db25a06b4ef031c12fdcee8a3818741

          SHA256

          963b596f0385f5be1b8ad2f7e5b4ff474aeb1a1a8d17d20ff67a1cd30ca70344

          SHA512

          a917504c89a8ec7b8fc5d89a683fce01ce45a160dbb98861cc2432c221a2f3e7aca15b7325967c171e2de2d7ce26ffa01ecef49c7b896b1a16daa5a3125eb4ca

        • C:\Users\Admin\script_cookie_encrypted.exe

          Filesize

          11.2MB

          MD5

          b50c04edf22d51016e00d6f385b41cc7

          SHA1

          22295a90e102a3ffdada9f52230fb9e604bac281

          SHA256

          2a7cae1fd866ff4f11e5c41c428b9b3c1078df3b523706d8a5145c55bd359ba9

          SHA512

          a574405593129fd729d8bf5fdcf6813cb68870cbb1124969def626db06069ccb2e18841c73ca5f34f71d33b4edd9c1982b6282a6f3e66b645e1043eff45f1f73

        • memory/3752-10-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-6-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-7-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-36-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-9-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-168-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-8-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-33-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/3752-4-0x0000000000400000-0x0000000000DED000-memory.dmp

          Filesize

          9.9MB

        • memory/4076-188-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/4076-189-0x0000000005010000-0x00000000050CA000-memory.dmp

          Filesize

          744KB

        • memory/4076-190-0x0000000005180000-0x00000000051E6000-memory.dmp

          Filesize

          408KB

        • memory/4076-191-0x00000000062B0000-0x000000000639A000-memory.dmp

          Filesize

          936KB

        • memory/5112-186-0x00007FFF28693000-0x00007FFF28695000-memory.dmp

          Filesize

          8KB

        • memory/5112-185-0x0000017A66870000-0x0000017A66878000-memory.dmp

          Filesize

          32KB

        • memory/5112-187-0x0000017A69040000-0x0000017A690F0000-memory.dmp

          Filesize

          704KB