Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/10/2024, 20:23
General
-
Target
2024-10-12_ce9a68dc735510dddbd76989ae2adb76_poet-rat_snatch.exe
-
Size
12.6MB
-
MD5
ce9a68dc735510dddbd76989ae2adb76
-
SHA1
a10ee37a11940d27598db61018446b4b6ddd2b1c
-
SHA256
3b9a545a879e311ca105cdb79c25e2aa262e6b7c97812959be677d994e5afce0
-
SHA512
e7185d04fb76f52e4a8f877a606f84b5195048c903d64881c1e0aed8f4bc63fa7383e35879409d4f8d1f64174fd3c0f344a60210a5e97beb4c8a31e7fb8ffb34
-
SSDEEP
196608:pnfHEFsISrhTJyU69zK2OGOOcg3RQb0jLNtTYz3:pfHE6IC/GOOc8QY/ET
Malware Config
Signatures
-
Detect Lumma Stealer payload V2 2 IoCs
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 56 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_ce9a68dc735510dddbd76989ae2adb76_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_ce9a68dc735510dddbd76989ae2adb76_poet-rat_snatch.exe"1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C start C:\Users\Admin\Steam\saved\adaptais\rqaiglb.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Steam\saved\adaptais\rqaiglb.exeC:\Users\Admin\Steam\saved\adaptais\rqaiglb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5c3ff36f2afb368e84a140201f8a4d5fa
SHA1100fc97b76b191ff745f95b3455b5640b21f0269
SHA256720c936eced83ebdc3ef65ecb3af1018a2bad155188a71b1b61fc476f53e1464
SHA512cde9034094b65a4e328752bdcbf23db5c9846259b2f656c04f3000827ce0878721ccc1f9c9dd850cab292d1b5647dd07c0877090d082f76947942e611f4ad9cc
-
Filesize
13KB
MD598a324a8cee8c2bf63f54eaa762b5a86
SHA127965caca83b9927a7fcce2c8f0a52b5e806b679
SHA25628b8424812c76765ff26f44d3e709e404b0531ba602bc7b1029c8038ba4c1d97
SHA512198a9da2af3213a58557e111f768b8e97f36f4938c608c03cb4a6ca8aa2b8e1cd7924dc3e7847877faddd20a0153da88a1c20cd9b6fa5651695b2a127a83782e
-
Filesize
2.9MB
MD55d320299f6fcefe759626f0a07dde4f2
SHA1aee8914fb193e8ebb7e57e55ef054776ac1781b1
SHA2563c8a6e9126bf505b86a4e4176d9d45de2965117d14b11d42ab3359d631024e7e
SHA5127e9fc8446cc0bf985ddcf40b457431d723b8124bd43038999aca03b42a2785b194808f458d60a5a8031feaa22340898df8f048e42ce549850ce931f6cfe3da29
-
Filesize
1.3MB
MD591b03eb0187c15ec0a16249db67fb7c0
SHA1b225b461034b352d88f0ad9bd6abbabfee62cff8
SHA256f8302c368b2710a87aa69d99157f396f825bcbcea03b6b1bdf3808da54c45725
SHA512448943e22b1be7c869a8394b5c9747d4409c7ce833525dc0c7d910bf6c71640c436135e5ea86d55cf2eca490d38ef1aa35df96c4f983ea6ba981b913c5925997
-
Filesize
22KB
MD5ae556c1ba47966f102128bbae8c217f8
SHA1e0c7e29c400eefffdd493cb03e97b776b1b2d717
SHA256a1e806c79fa764cb481aa8bba5bca7f503c9f3711bf380503d588b0d6eccbd63
SHA51278eef37e4199dd34d560a5964d2fef14a2ce360692319661a7d155ffba87e32291715299a8e1592ff211ea3eb44a3f5f53ee918d8a3853727fec941210654cef
-
Filesize
14KB
MD57b1d0579348444cc11fb1cc3fbf00514
SHA14fb011cd891f7570573579cdc04dc1038b3a5563
SHA2569af7a22185117967727fe19c3db45e96c14cda3b0607eb576d3d9cca0de9f689
SHA5123cd89c0e3c43ab71852041ddc962a215fe411e7728989ba20481b7efe598aec3296c3174fdcd63c6908744800d784258e9195e27f7614cdb70131aa8db502880
-
Filesize
13KB
MD54ee840e71054942e6a2f28448c690d60
SHA113a4e387358245952320cbbb478295d4c047ba07
SHA256a11083ee812b6cc9a0e93ce75856ca16802024c3a13618a2f6c4859cdefa58b5
SHA512b8ac3bb249e6de012f54b772fc75c459a7b15afdab571e93a740a7a0b0f4d402d9210e26e7e472bbe7b982858edbb7f832194d9d62b3ae230ac6e9eea4ba963b
-
Filesize
8.2MB
MD50a5eb75d76c319da5f902b76c843a3c7
SHA1b2c8dd2194756001223568f6d1ff3e36f121d7d7
SHA25639222481d69aa4d92a5c4d5c094a86909ebff762f6336f1a186fa94d3cc01012
SHA512b5d58fbc14faf141d72b755a55c5f980ef5c86192a14b6534d2930f9f0198557909da060dd3bb81d72fbf5ab1ee0b690e772af99e9bf7025fb4913e4874bb7b0
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
8.3MB
-
Filesize
4KB