2531a828bca4b0d5a58fe0ae6eecc564b815d7ed11fdaf64c954e395cc7f99d2

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-10-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe
Size

10.1MB
MD5

aac2efd87b5ab7616f654fe8d6df0ee3
SHA1

d42e3d253a83d03bd221bff33a8c9683f2786fa9
SHA256

2531a828bca4b0d5a58fe0ae6eecc564b815d7ed11fdaf64c954e395cc7f99d2
SHA512

0cd8d0c99d45ca96132087d0e7aaa0e01876b0eba7beeba9d6a417118114c1d7923ae22956f74be3549ae38a499961d7be9a092b44fe7cc7e45e7a9ed12658b3
SSDEEP

98304:QS9YbqjMhhxG9OhHPymsT9c3Usft9ePxE8B2v/ZmkzL:r9Y1hhxkk6N9c3Ust9ePST1zL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe

description pid process

Token: SeDebugPrivilege 2040 2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe

description	pid	process
Token: SeDebugPrivilege	2040	2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe

description	pid	process	target process
PID 2040 wrote to memory of 2808	2040	2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe	attrib.exe
PID 2040 wrote to memory of 2808	2040	2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2808 attrib.exe

pid	process
2808	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-10-26_aac2efd87b5ab7616f654fe8d6df0ee3_ngrbot_poet-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads