Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2024 00:44

General

  • Target

    2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe

  • Size

    10.5MB

  • MD5

    737fb056093df619a87969db45379c80

  • SHA1

    82702168b2cffe8c88405b4cb9f6ddf67e0997da

  • SHA256

    e1a2f6f904d28fe6d650536a835e2f505ed865d24e9cbcf7008dd7ad3269221f

  • SHA512

    1d1a398301e52f1660ce770fa9ddcf25b114e003ef5d9e5b83719af5a6f0158a1ac57536c403a9d89f0a8908f16ef471115b39e67e38f525fd9a0031dfd439ae

  • SSDEEP

    98304:UW3DPzlu4JkukPMoej+ZDLbE5wDMrd+s71Kq:LD7lu4JgMoejoLI5wQMU

Malware Config

Signatures

  • Detects MeshAgent payload 1 IoCs
  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 64 IoCs
  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "((Get-WMIObject -ClassName Win32_ComputerSystem).Username).Split('\')[1]"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell "Add-MpPreference -ExclusionExtension '.exe' -Force"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4244
    • C:\Users\AppData\Local\svchost\svchost.exe
      C:\Users\\AppData\Local\svchost\svchost.exe -install
      2⤵
      • Sets service image path in registry
      • Executes dropped EXE
      PID:2404
  • C:\Users\AppData\Local\svchost\svchost.exe
    "C:\Users\AppData\Local\svchost\svchost.exe" --meshServiceName="Microsoft"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Windows\System32\wbem\wmic.exe
      wmic SystemEnclosure get ChassisTypes
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5100
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3880
    • C:\Windows\System32\wbem\wmic.exe
      wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3772
    • C:\Windows\system32\wbem\wmic.exe
      wmic os get oslanguage /FORMAT:LIST
      2⤵
        PID:1180
      • C:\Windows\System32\wbem\wmic.exe
        wmic SystemEnclosure get ChassisTypes
        2⤵
          PID:2176
        • C:\Windows\System32\wbem\wmic.exe
          wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
          2⤵
            PID:1856
        • C:\Users\AppData\Local\svchost\svchost.exe
          "C:\Users\AppData\Local\svchost\svchost.exe" --meshServiceName="Microsoft"
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4316
          • C:\Windows\System32\wbem\wmic.exe
            wmic SystemEnclosure get ChassisTypes
            2⤵
              PID:808
            • C:\Windows\system32\wbem\wmic.exe
              wmic os get oslanguage /FORMAT:LIST
              2⤵
                PID:4436
              • C:\Windows\System32\wbem\wmic.exe
                wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                2⤵
                  PID:1884
                • C:\Windows\System32\wbem\wmic.exe
                  wmic SystemEnclosure get ChassisTypes
                  2⤵
                    PID:5048
                  • C:\Windows\System32\wbem\wmic.exe
                    wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"
                    2⤵
                      PID:3268
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -noprofile -nologo -command -
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:5056

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                    Filesize

                    2KB

                    MD5

                    6cf293cb4d80be23433eecf74ddb5503

                    SHA1

                    24fe4752df102c2ef492954d6b046cb5512ad408

                    SHA256

                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                    SHA512

                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    1KB

                    MD5

                    9fd2ab8d8464245af4bd0c32050b550e

                    SHA1

                    000417ac42c7f17434946571a95f74baec153ca7

                    SHA256

                    e5e21171532631873c188b53516e679f08a49655ce2a2e376dcd3a7384ef3c04

                    SHA512

                    c1530182a8a0ffb59b01a79a8ce6627bee3c67296d2003baa5377a309f219f718caee9f90baff52c36d54093ced82111f210a2c6209e4f06b5cc5f9b3cfc1345

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqex2oej.dtj.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\AppData\Local\svchost\svchost.db

                    Filesize

                    131KB

                    MD5

                    5fd5f585aecb169188c49fd0c26a290c

                    SHA1

                    1a9436d446e751d399d5b13612d3f30c438f051a

                    SHA256

                    665a95dd9759ce03ae94a53b527694e07bc58fa08a181b3802ea7c1f8a4df2be

                    SHA512

                    aeaca91b8446f8662cdd54ccb0d8bfadd4689a4f3012b24b8f0f271dfc140a137d2113ee4c77ecbf94749057ded4819e632d4e1c99fc4d158015267ee2f3386f

                  • C:\Users\AppData\Local\svchost\svchost.exe

                    Filesize

                    5.3MB

                    MD5

                    5b6be6790ee80859332624deae0567b2

                    SHA1

                    8597c1a83eb2490cf20026acd20bfbd539fc4b7f

                    SHA256

                    9ae2520522990491e6325e94ee1e6cedf931cfc0af2e6a9d1e0f760ab9b47bad

                    SHA512

                    a8214f8f4148b55de1fef4e72a06211e5840ced5a134b319be7d4d25e77d0edded5f26b8cbfa86c8b5df9067b6f7c9ddac1d709231f1fe70d4867570e907cbb6

                  • C:\Users\AppData\Local\svchost\svchost.msh

                    Filesize

                    22KB

                    MD5

                    90f91efb0b6cc632ea6b2bb3a6d5fb40

                    SHA1

                    e46a39e7252e086f34d64c3d720442cd325de506

                    SHA256

                    7db6fa16d92fa026ba88337e51623caea566a78eb275af77905286a533792fc9

                    SHA512

                    f511124b19a4f05e09f253f5f63e991694565247f9c09430368f53d5466ecb8822811107c7c0a9e91e8d1b0ff85bfa37a243b0635eb893c8fae39ea8152c3928

                  • C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D13E5EDA61C350945D5E8F5200F1B47F25D4BF3

                    Filesize

                    1KB

                    MD5

                    1d4694d8cfb642234e094e2cc3189d3f

                    SHA1

                    3033dba5ddea5215ad9849983794c06ebc3518c2

                    SHA256

                    b65c38dff69c258e4bd1ee02d2a2c52ee824526d2c6d1f363acabaebda2ce1f4

                    SHA512

                    d0fe62e0a6043409e9c354504563b0c2f6ff713bfab0cd8a0e50422fb73a42fb5b88cae9de396df388ca8d6d66852266bd8ed063b38076e87dca9b002464cb09

                  • C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\7DF32C3D6039845D99F9F43AAC4CB10C18B56A0C

                    Filesize

                    1KB

                    MD5

                    a171bca270f574c55fc1b09e770db2c6

                    SHA1

                    cee0a3febd2043afe7e4c29014ce9f04fb726bf9

                    SHA256

                    de8e035bd213cc876beb3d9625bce354524af49a922d2e2598cd4bcdf64924b0

                    SHA512

                    13eb7695b78c0c8f4b502ebaa9edc868e727988a42fe23adeef32e3e6071b6e26c38535af026be1cca5b598c2e0e61ab7e4b8bd3f7cafd14fc99343a5dec2769

                  • memory/4244-32-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4244-18-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4244-19-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4244-30-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4612-12-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4612-16-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4612-11-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/4612-0-0x00007FFF2B5F3000-0x00007FFF2B5F5000-memory.dmp

                    Filesize

                    8KB

                  • memory/4612-1-0x000001A5B3430000-0x000001A5B3452000-memory.dmp

                    Filesize

                    136KB

                  • memory/4612-13-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

                    Filesize

                    10.8MB

                  • memory/5056-85-0x000001873AE70000-0x000001873AEB4000-memory.dmp

                    Filesize

                    272KB

                  • memory/5056-86-0x000001873AF40000-0x000001873AFB6000-memory.dmp

                    Filesize

                    472KB