General
-
Target
2024-10-10_32f3fc40a78d5839c065e23990a01820_poet-rat_snatch
-
Size
7.5MB
-
Sample
241010-lbz3waycmq
-
MD5
32f3fc40a78d5839c065e23990a01820
-
SHA1
16ae351043266a1923e1bcf8f68a23fde8cdd796
-
SHA256
a0ff69955bc8a6f67e015218a5abc3e8b93d60f557901ac20a5be378150084de
-
SHA512
4a506aeae34bd2e9ee9f7b9beb2394333e302247782d9440bce88af9b03cd4f32a6074cb1a70d26bb43ddcbc8382d98829234d619f58013e28615191b7143093
-
SSDEEP
98304:xgt1C/hHnXjE0XimKK/f7NW5Sc5VM3Byg93wwm6lUF1:xT/hHngMfcs4VCnWwm3
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_32f3fc40a78d5839c065e23990a01820_poet-rat_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-10_32f3fc40a78d5839c065e23990a01820_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
lumma
https://drawwyobstacw.sbs
https://condifendteu.sbs
https://ehticsprocw.sbs
https://vennurviot.sbs
https://resinedyw.sbs
https://enlargkiw.sbs
https://allocatinow.sbs
https://mathcucom.sbs
Extracted
stealc
mainteam
http://95.182.96.50
-
url_path
/2aced82320799c96.php
Targets
-
-
Target
2024-10-10_32f3fc40a78d5839c065e23990a01820_poet-rat_snatch
-
Size
7.5MB
-
MD5
32f3fc40a78d5839c065e23990a01820
-
SHA1
16ae351043266a1923e1bcf8f68a23fde8cdd796
-
SHA256
a0ff69955bc8a6f67e015218a5abc3e8b93d60f557901ac20a5be378150084de
-
SHA512
4a506aeae34bd2e9ee9f7b9beb2394333e302247782d9440bce88af9b03cd4f32a6074cb1a70d26bb43ddcbc8382d98829234d619f58013e28615191b7143093
-
SSDEEP
98304:xgt1C/hHnXjE0XimKK/f7NW5Sc5VM3Byg93wwm6lUF1:xT/hHngMfcs4VCnWwm3
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3