Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 10:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe
-
Size
9.7MB
-
MD5
2b11bb763534effd46a0f0993bb2fcf2
-
SHA1
e057cecfde20b6533d30201535a671f9d63b8a9f
-
SHA256
085caa025a17f2507edcfdc032a89d2edb25a41ad22c73e66bde4df25da0e3ce
-
SHA512
c7088eb3de7942ad5200a937ce569ce83687165d9a481001fa6badbc470bb7cc32f6996c7771d08e1178faef02a4d440ed3d9c0a828496683ff1fef0a8eefa1e
-
SSDEEP
98304:81lm6pg9m3XVdiXJmypg+5jEr0b8EAdVM1MEKE:W1q9zzjErc1nR
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
reagentc.exedescription ioc Process File opened for modification C:\Windows\system32\Recovery reagentc.exe File opened for modification C:\Windows\system32\Recovery\ReAgent.xml reagentc.exe -
Drops file in Windows directory 4 IoCs
Processes:
reagentc.exedescription ioc Process File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log reagentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml reagentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml reagentc.exe File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log reagentc.exe -
Kills process with taskkill 15 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid Process 2052 taskkill.exe 652 taskkill.exe 4864 taskkill.exe 2836 taskkill.exe 2852 taskkill.exe 4836 taskkill.exe 1792 taskkill.exe 4348 taskkill.exe 3784 taskkill.exe 1700 taskkill.exe 4928 taskkill.exe 3936 taskkill.exe 1932 taskkill.exe 4904 taskkill.exe 1980 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid Process Token: SeDebugPrivilege 4348 taskkill.exe Token: SeDebugPrivilege 2836 taskkill.exe Token: SeDebugPrivilege 3936 taskkill.exe Token: SeDebugPrivilege 2052 taskkill.exe Token: SeDebugPrivilege 652 taskkill.exe Token: SeDebugPrivilege 3784 taskkill.exe Token: SeDebugPrivilege 2852 taskkill.exe Token: SeDebugPrivilege 4864 taskkill.exe Token: SeDebugPrivilege 1932 taskkill.exe Token: SeDebugPrivilege 4836 taskkill.exe Token: SeDebugPrivilege 1792 taskkill.exe Token: SeDebugPrivilege 4904 taskkill.exe Token: SeDebugPrivilege 1700 taskkill.exe Token: SeDebugPrivilege 1980 taskkill.exe Token: SeDebugPrivilege 4928 taskkill.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exedescription pid Process procid_target PID 1312 wrote to memory of 4348 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 83 PID 1312 wrote to memory of 4348 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 83 PID 1312 wrote to memory of 2836 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 86 PID 1312 wrote to memory of 2836 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 86 PID 1312 wrote to memory of 3936 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 88 PID 1312 wrote to memory of 3936 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 88 PID 1312 wrote to memory of 2052 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 90 PID 1312 wrote to memory of 2052 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 90 PID 1312 wrote to memory of 652 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 93 PID 1312 wrote to memory of 652 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 93 PID 1312 wrote to memory of 3784 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 96 PID 1312 wrote to memory of 3784 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 96 PID 1312 wrote to memory of 2852 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 98 PID 1312 wrote to memory of 2852 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 98 PID 1312 wrote to memory of 4864 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 100 PID 1312 wrote to memory of 4864 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 100 PID 1312 wrote to memory of 1932 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 102 PID 1312 wrote to memory of 1932 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 102 PID 1312 wrote to memory of 4836 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 104 PID 1312 wrote to memory of 4836 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 104 PID 1312 wrote to memory of 1792 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 107 PID 1312 wrote to memory of 1792 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 107 PID 1312 wrote to memory of 4904 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 109 PID 1312 wrote to memory of 4904 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 109 PID 1312 wrote to memory of 1700 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 111 PID 1312 wrote to memory of 1700 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 111 PID 1312 wrote to memory of 1980 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 113 PID 1312 wrote to memory of 1980 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 113 PID 1312 wrote to memory of 4928 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 115 PID 1312 wrote to memory of 4928 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 115 PID 1312 wrote to memory of 548 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 117 PID 1312 wrote to memory of 548 1312 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM firefox.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM brave.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM opera.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM kometa.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:652
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM orbitum.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3784
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM centbrowser.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM 7star.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sputnik.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM vivaldi.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM epicprivacybrowser.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM uran.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM yandex.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM iridium.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\system32\reagentc.exereagentc.exe /disable2⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:548
-