Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2024 00:27

General

  • Target

    2024-10-29_37834eca6c068c551b49202739e6882e_ngrbot_poet-rat_snatch.exe

  • Size

    9.9MB

  • MD5

    37834eca6c068c551b49202739e6882e

  • SHA1

    83dc6b9e26f773758d042f1cc92bfd17f396edc3

  • SHA256

    9d60a15cf6779912cc49ce36597b2264f97071c4afc61c370454931083df2e3f

  • SHA512

    b880d2ec14ad71d9e2449422758b6ba36c9d726a3281cc9867bfdee9e46c3e523d8f7cacecef61d07399e9057f4062aa5ad954c58e1b5278879229890ba0f3da

  • SSDEEP

    98304:PzU4brhxBASgf/gEpiji6Ig8TWAREIICafZm/mbnXg:PxrhxBAGZji6IdThyRTXg

Malware Config

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1298438839865577564/LcdRm0rKPE01ApFPl9RQHGqhcuExeiqKGpghrB8Lv3iKniiyEa0mVBhFySte_oBx7wyQ

Signatures

  • Skuld family
  • Skuld stealer

    An info stealer written in Go lang.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-29_37834eca6c068c551b49202739e6882e_ngrbot_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-29_37834eca6c068c551b49202739e6882e_ngrbot_poet-rat_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-10-29_37834eca6c068c551b49202739e6882e_ngrbot_poet-rat_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:4396
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
      2⤵
      • Views/modifies file attributes
      PID:2092
    • C:\Windows\System32\Wbem\wmic.exe
      wmic csproduct get UUID
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

    Filesize

    9.9MB

    MD5

    37834eca6c068c551b49202739e6882e

    SHA1

    83dc6b9e26f773758d042f1cc92bfd17f396edc3

    SHA256

    9d60a15cf6779912cc49ce36597b2264f97071c4afc61c370454931083df2e3f

    SHA512

    b880d2ec14ad71d9e2449422758b6ba36c9d726a3281cc9867bfdee9e46c3e523d8f7cacecef61d07399e9057f4062aa5ad954c58e1b5278879229890ba0f3da