7fec036f563f41e4829910e54eca7c152f36739e54a80dfdc5d1d2c5e00dbcc2

Analysis

max time kernel
133s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe
Size

9.9MB
MD5

f402250a79e48d8bd930fef38592c220
SHA1

80d1cf2b52c58c54bfc55a303c816ada540266bb
SHA256

7fec036f563f41e4829910e54eca7c152f36739e54a80dfdc5d1d2c5e00dbcc2
SHA512

9083454566ffd50a2eed6ce8d83b16adb447be3649f21adf4b62c35795e7b6818cd01209432ed0d932746b6dd6f64fc5d92d955de3a64d0508da7c7ab2945b5d
SSDEEP

98304:mpbm4V9MpExwzKVaZr2bpHVsiuR/6QjWEmB2v/ZmHzU:CmTpExwmVNVsiuV6QjTZezU

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe

description pid process

Token: SeDebugPrivilege 4264 2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe

description	pid	process
Token: SeDebugPrivilege	4264	2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe

description	pid	process	target process
PID 4264 wrote to memory of 5036	4264	2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe	attrib.exe
PID 4264 wrote to memory of 5036	4264	2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe	attrib.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5036 attrib.exe

pid	process
5036	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-11-05_f402250a79e48d8bd930fef38592c220_ngrbot_poet-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads