Malware Analysis Report

2024-12-07 19:32

Sample ID 241114-mvl6ss1rdl
Target 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch
SHA256 085caa025a17f2507edcfdc032a89d2edb25a41ad22c73e66bde4df25da0e3ce
Tags
credential_access discovery spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

085caa025a17f2507edcfdc032a89d2edb25a41ad22c73e66bde4df25da0e3ce

Threat Level: Shows suspicious behavior

The file 2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch was found to be: Shows suspicious behavior.

Malicious Activity Summary

credential_access discovery spyware stealer

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

Browser Information Discovery

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 10:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 10:47

Reported

2024-11-14 10:49

Platform

win7-20241010-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 10:47

Reported

2024-11-14 10:49

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe"

Signatures

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\Recovery C:\Windows\system32\reagentc.exe N/A
File opened for modification C:\Windows\system32\Recovery\ReAgent.xml C:\Windows\system32\reagentc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log C:\Windows\system32\reagentc.exe N/A
File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml C:\Windows\system32\reagentc.exe N/A
File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml C:\Windows\system32\reagentc.exe N/A
File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log C:\Windows\system32\reagentc.exe N/A

Browser Information Discovery

discovery

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1312 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\taskkill.exe
PID 1312 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\reagentc.exe
PID 1312 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe C:\Windows\system32\reagentc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe

"C:\Users\Admin\AppData\Local\Temp\2024-11-14_2b11bb763534effd46a0f0993bb2fcf2_frostygoop_luca-stealer_poet-rat_snatch.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM firefox.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM brave.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM opera.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM kometa.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM orbitum.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM centbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM 7star.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM sputnik.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM vivaldi.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM epicprivacybrowser.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM uran.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM yandex.exe

C:\Windows\system32\taskkill.exe

taskkill /F /IM iridium.exe

C:\Windows\system32\reagentc.exe

reagentc.exe /disable

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

N/A