Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-10-2024 10:55
General
-
Target
2024-10-07_373eb47a07dceb67a31a25407d943cf3_poet-rat_sliver_snatch.exe
-
Size
18.6MB
-
MD5
373eb47a07dceb67a31a25407d943cf3
-
SHA1
c947f33e8663938049847378eda362cc2057fa60
-
SHA256
303d0b7ddbb66de9628edb74cf366c75a5a3bfa19b3cc0829c1651cebb195a74
-
SHA512
3fc257b14511b7854cbfa61f9ecdcfed6f58d48fb4a1c26b3be00ca81abc1607f20b4d85c38bcd3c4cca007455537feeab05cb728b19606868af515deede395b
-
SSDEEP
196608:U3wFvVD54spjYK3KeSoTZXTTHmLr4Mr82IeZzRs:N5fp8K3/SYTHvEs
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-07_373eb47a07dceb67a31a25407d943cf3_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-07_373eb47a07dceb67a31a25407d943cf3_poet-rat_sliver_snatch.exe"1⤵
- System Location Discovery: System Language Discovery