Malware Analysis Report

2024-10-23 20:21

Sample ID 241003-a3v3fsvhkn
Target 2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch
SHA256 e1a2f6f904d28fe6d650536a835e2f505ed865d24e9cbcf7008dd7ad3269221f
Tags
execution meshagent backdoor discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e1a2f6f904d28fe6d650536a835e2f505ed865d24e9cbcf7008dd7ad3269221f

Threat Level: Known bad

The file 2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch was found to be: Known bad.

Malicious Activity Summary

execution meshagent backdoor discovery persistence rat trojan

Detects MeshAgent payload

MeshAgent

Command and Scripting Interpreter: PowerShell

Sets service image path in registry

Executes dropped EXE

Checks installed software on the system

Drops file in System32 directory

Unsigned PE

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-03 00:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-03 00:44

Reported

2024-10-03 00:47

Platform

win7-20240903-en

Max time kernel

120s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell "((Get-WMIObject -ClassName Win32_ComputerSystem).Username).Split('\')[1]"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell "Add-MpPreference -ExclusionExtension '.exe' -Force"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sktelecom.netlify.app udp
DE 3.72.140.173:443 sktelecom.netlify.app tcp

Files

memory/2796-4-0x000007FEF619E000-0x000007FEF619F000-memory.dmp

memory/2796-7-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

memory/2796-6-0x0000000002490000-0x0000000002498000-memory.dmp

memory/2796-8-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

memory/2796-5-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

memory/2796-9-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

memory/2796-10-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

memory/2796-11-0x000007FEF5EE0000-0x000007FEF687D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UJFSJAOYQ3DRQT1S6Q6M.temp

MD5 1151bb591d542b67c3aa743989c3a510
SHA1 aa9a581b19fdb384d943a8c082265ebcc3812792
SHA256 658df6c381c46bc52d942e8bfebbb5e8a5f8fdca1b053041b81a10f0194cf4d7
SHA512 2297fe2d3053e03f1baf9dbc9559e842fe76c28d100158f04e7ff8d6b189195645d25ae87a696e1ac6d770ba1cee36672d32f06c983e6a3ab7f6ddbbffd5e814

memory/2604-24-0x000000001B240000-0x000000001B522000-memory.dmp

memory/2604-25-0x0000000002310000-0x0000000002318000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab9494.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar94A6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-03 00:44

Reported

2024-10-03 00:47

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe"

Signatures

Detects MeshAgent payload

Description Indicator Process Target
N/A N/A N/A N/A

MeshAgent

rat trojan backdoor meshagent

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Microsoft\ImagePath = "\"C:\\Users\\AppData\\Local\\svchost\\svchost.exe\" --meshServiceName=\"Microsoft\"" C:\Users\AppData\Local\svchost\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\AppData\Local\svchost\svchost.exe N/A
N/A N/A C:\Users\AppData\Local\svchost\svchost.exe N/A
N/A N/A C:\Users\AppData\Local\svchost\svchost.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\ntasn1.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\bcryptprimitives.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\sechost.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\ntdll.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\win32u.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\msvcrt.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\ntasn1.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dbghelp.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\ucrtbase.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\DLL\iphlpapi.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\DLL\dbgcore.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\DLL\bcrypt.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D13E5EDA61C350945D5E8F5200F1B47F25D4BF3 C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\msvcp_win.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\msvcrt.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\shcore.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\ntasn1.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\ntdll.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\gdiplus.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\Kernel.Appcore.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\sechost.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\gdiplus.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\DLL\iphlpapi.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\kernelbase.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\shell32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\ole32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\ole32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\kernel32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\gdi32full.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\crypt32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\ole32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\rpcrt4.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\msvcp_win.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\ws2_32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\combase.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\comctl32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\gdiplus.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D13E5EDA61C350945D5E8F5200F1B47F25D4BF3 C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\MeshService64.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\ws2_32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\shell32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\bcrypt.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\80F4EBC7FBE918362C89B5522B5C18642FAB3C35 C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\symbols\DLL\kernel32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\advapi32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\DLL\dbgcore.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\msvcrt.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\crypt32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\dll\kernelbase.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\user32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\gdi32.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\gdi32full.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A
File opened for modification C:\Windows\System32\win32u.pdb C:\Users\AppData\Local\svchost\svchost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Users\AppData\Local\svchost\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Users\AppData\Local\svchost\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Users\AppData\Local\svchost\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Users\AppData\Local\svchost\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133723898994403957" C:\Users\AppData\Local\svchost\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Users\AppData\Local\svchost\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Users\AppData\Local\svchost\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\System32\wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3264 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3264 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3264 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3264 wrote to memory of 4244 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3264 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe C:\Users\AppData\Local\svchost\svchost.exe
PID 3264 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe C:\Users\AppData\Local\svchost\svchost.exe
PID 4544 wrote to memory of 5100 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 5100 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 3880 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\system32\wbem\wmic.exe
PID 4544 wrote to memory of 3880 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\system32\wbem\wmic.exe
PID 4544 wrote to memory of 3772 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 3772 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 1180 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\system32\wbem\wmic.exe
PID 4544 wrote to memory of 1180 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\system32\wbem\wmic.exe
PID 4544 wrote to memory of 2176 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 2176 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 1856 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4544 wrote to memory of 1856 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 808 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 808 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 4436 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\system32\wbem\wmic.exe
PID 4316 wrote to memory of 4436 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\system32\wbem\wmic.exe
PID 4316 wrote to memory of 1884 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 1884 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 5048 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 5048 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 3268 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 3268 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\wbem\wmic.exe
PID 4316 wrote to memory of 5056 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4316 wrote to memory of 5056 N/A C:\Users\AppData\Local\svchost\svchost.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-03_737fb056093df619a87969db45379c80_poet-rat_snatch.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell "((Get-WMIObject -ClassName Win32_ComputerSystem).Username).Split('\')[1]"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell "Add-MpPreference -ExclusionExtension '.exe' -Force"

C:\Users\AppData\Local\svchost\svchost.exe

C:\Users\\AppData\Local\svchost\svchost.exe -install

C:\Users\AppData\Local\svchost\svchost.exe

"C:\Users\AppData\Local\svchost\svchost.exe" --meshServiceName="Microsoft"

C:\Windows\System32\wbem\wmic.exe

wmic SystemEnclosure get ChassisTypes

C:\Windows\system32\wbem\wmic.exe

wmic os get oslanguage /FORMAT:LIST

C:\Windows\System32\wbem\wmic.exe

wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"

C:\Windows\system32\wbem\wmic.exe

wmic os get oslanguage /FORMAT:LIST

C:\Windows\System32\wbem\wmic.exe

wmic SystemEnclosure get ChassisTypes

C:\Windows\System32\wbem\wmic.exe

wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"

C:\Users\AppData\Local\svchost\svchost.exe

"C:\Users\AppData\Local\svchost\svchost.exe" --meshServiceName="Microsoft"

C:\Windows\System32\wbem\wmic.exe

wmic SystemEnclosure get ChassisTypes

C:\Windows\system32\wbem\wmic.exe

wmic os get oslanguage /FORMAT:LIST

C:\Windows\System32\wbem\wmic.exe

wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"

C:\Windows\System32\wbem\wmic.exe

wmic SystemEnclosure get ChassisTypes

C:\Windows\System32\wbem\wmic.exe

wmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -noprofile -nologo -command -

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 sktelecom.netlify.app udp
DE 3.72.140.173:443 sktelecom.netlify.app tcp
US 8.8.8.8:53 25.125.209.23.in-addr.arpa udp
US 8.8.8.8:53 173.140.72.3.in-addr.arpa udp
US 8.8.8.8:53 api.skt.cam udp
US 8.8.8.8:53 api.logflare.app udp
US 172.67.147.63:443 api.skt.cam tcp
US 104.21.55.56:443 api.logflare.app tcp
US 8.8.8.8:53 microsoft.devq.workers.dev udp
US 172.67.212.100:443 microsoft.devq.workers.dev tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 63.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 56.55.21.104.in-addr.arpa udp
US 8.8.8.8:53 100.212.67.172.in-addr.arpa udp
US 8.8.8.8:53 sktelecom.duckdns.org udp
KR 203.234.238.140:443 sktelecom.duckdns.org tcp
US 8.8.8.8:53 140.238.234.203.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
KR 203.234.238.140:443 sktelecom.duckdns.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 27.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4612-0-0x00007FFF2B5F3000-0x00007FFF2B5F5000-memory.dmp

memory/4612-1-0x000001A5B3430000-0x000001A5B3452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqex2oej.dtj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4612-11-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

memory/4612-12-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

memory/4612-13-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

memory/4612-16-0x00007FFF2B5F0000-0x00007FFF2C0B1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

memory/4244-18-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

memory/4244-19-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9fd2ab8d8464245af4bd0c32050b550e
SHA1 000417ac42c7f17434946571a95f74baec153ca7
SHA256 e5e21171532631873c188b53516e679f08a49655ce2a2e376dcd3a7384ef3c04
SHA512 c1530182a8a0ffb59b01a79a8ce6627bee3c67296d2003baa5377a309f219f718caee9f90baff52c36d54093ced82111f210a2c6209e4f06b5cc5f9b3cfc1345

memory/4244-30-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

memory/4244-32-0x00007FFF2B540000-0x00007FFF2C001000-memory.dmp

C:\Users\AppData\Local\svchost\svchost.exe

MD5 5b6be6790ee80859332624deae0567b2
SHA1 8597c1a83eb2490cf20026acd20bfbd539fc4b7f
SHA256 9ae2520522990491e6325e94ee1e6cedf931cfc0af2e6a9d1e0f760ab9b47bad
SHA512 a8214f8f4148b55de1fef4e72a06211e5840ced5a134b319be7d4d25e77d0edded5f26b8cbfa86c8b5df9067b6f7c9ddac1d709231f1fe70d4867570e907cbb6

C:\Users\AppData\Local\svchost\svchost.msh

MD5 90f91efb0b6cc632ea6b2bb3a6d5fb40
SHA1 e46a39e7252e086f34d64c3d720442cd325de506
SHA256 7db6fa16d92fa026ba88337e51623caea566a78eb275af77905286a533792fc9
SHA512 f511124b19a4f05e09f253f5f63e991694565247f9c09430368f53d5466ecb8822811107c7c0a9e91e8d1b0ff85bfa37a243b0635eb893c8fae39ea8152c3928

C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4D13E5EDA61C350945D5E8F5200F1B47F25D4BF3

MD5 1d4694d8cfb642234e094e2cc3189d3f
SHA1 3033dba5ddea5215ad9849983794c06ebc3518c2
SHA256 b65c38dff69c258e4bd1ee02d2a2c52ee824526d2c6d1f363acabaebda2ce1f4
SHA512 d0fe62e0a6043409e9c354504563b0c2f6ff713bfab0cd8a0e50422fb73a42fb5b88cae9de396df388ca8d6d66852266bd8ed063b38076e87dca9b002464cb09

C:\Users\AppData\Local\svchost\svchost.db

MD5 5fd5f585aecb169188c49fd0c26a290c
SHA1 1a9436d446e751d399d5b13612d3f30c438f051a
SHA256 665a95dd9759ce03ae94a53b527694e07bc58fa08a181b3802ea7c1f8a4df2be
SHA512 aeaca91b8446f8662cdd54ccb0d8bfadd4689a4f3012b24b8f0f271dfc140a137d2113ee4c77ecbf94749057ded4819e632d4e1c99fc4d158015267ee2f3386f

C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\7DF32C3D6039845D99F9F43AAC4CB10C18B56A0C

MD5 a171bca270f574c55fc1b09e770db2c6
SHA1 cee0a3febd2043afe7e4c29014ce9f04fb726bf9
SHA256 de8e035bd213cc876beb3d9625bce354524af49a922d2e2598cd4bcdf64924b0
SHA512 13eb7695b78c0c8f4b502ebaa9edc868e727988a42fe23adeef32e3e6071b6e26c38535af026be1cca5b598c2e0e61ab7e4b8bd3f7cafd14fc99343a5dec2769

memory/5056-85-0x000001873AE70000-0x000001873AEB4000-memory.dmp

memory/5056-86-0x000001873AF40000-0x000001873AFB6000-memory.dmp