General
-
Target
2024-10-13_7b97ef9a30e3bb6cb187160261d1aa8c_poet-rat_snatch
-
Size
5.0MB
-
Sample
241013-tgm99svdla
-
MD5
7b97ef9a30e3bb6cb187160261d1aa8c
-
SHA1
4a7ef7bc9040887ada6820c8d8d340ab0fe323dd
-
SHA256
23bce4e9bb4cb146469db5a7541fcec7c6a1f668dcb2fad4e3cd92b7dd7f2a3b
-
SHA512
14f542a6aa45e225cbaf6b7972c7c7f2ae3a3c7445e07759ea2936f97f8dee1a642eb12e6edae712c2bce68b2a7273288c237f9d174b74f8369676be3c0685bc
-
SSDEEP
49152:pgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGdJS5Bn:m4e4uPpVW6gTVegO7DfEK+ea
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_7b97ef9a30e3bb6cb187160261d1aa8c_poet-rat_snatch.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-13_7b97ef9a30e3bb6cb187160261d1aa8c_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
meshagent
2
TacticalRMM
http://mesh.angaragk.ru:443/agent.ashx
-
mesh_id
0x56A26EC09E3FA927D339904D01102E90548D375CAFC74B6A9B21011902B2FFC2569189BDF90C1790D2CF2F94A7C81CB2
-
server_id
8B913661A7155C8CE70D79BDB7A0A320EB0AC97317E912B7A86A74D5011A68F9D4FEC39D695F8328B1B76FD67C3C40C8
-
wss
wss://mesh.angaragk.ru:443/agent.ashx
Targets
-
-
Target
2024-10-13_7b97ef9a30e3bb6cb187160261d1aa8c_poet-rat_snatch
-
Size
5.0MB
-
MD5
7b97ef9a30e3bb6cb187160261d1aa8c
-
SHA1
4a7ef7bc9040887ada6820c8d8d340ab0fe323dd
-
SHA256
23bce4e9bb4cb146469db5a7541fcec7c6a1f668dcb2fad4e3cd92b7dd7f2a3b
-
SHA512
14f542a6aa45e225cbaf6b7972c7c7f2ae3a3c7445e07759ea2936f97f8dee1a642eb12e6edae712c2bce68b2a7273288c237f9d174b74f8369676be3c0685bc
-
SSDEEP
49152:pgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGdJS5Bn:m4e4uPpVW6gTVegO7DfEK+ea
-
Detects MeshAgent payload
-
Blocklisted process makes network request
-
Sets service image path in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1