Overview

overview

7

Static

static

3

2024-11-15...ch.exe

windows7-x64

1

2024-11-15...ch.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    93s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-11-2024 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch.exe

  • Size

    21.5MB

  • MD5

    378c604b0a9cfe2dd772825b919525c1

  • SHA1

    e7ccec97c078a8800194682ce3ed893546f51d37

  • SHA256

    482180cc808f066049147214bc6a64e43c8336e1037a5bcaf4680bcece569ac0

  • SHA512

    25829b523609a57e9856ab92f7a813383bb6acb874113bd3e3c6f8ce9e5c93188dc39a9ff605e7b679c2519f2dc96c786693ab037c637c1bd089096844fcc63a

  • SSDEEP

    393216:y4PybIvnlSarK/0Y40jq3T9lfn32mYM8sIqkcUsMoSIceieYX208gJ:y4M6ljrYjq35Nn3rYspkdsMMceieYX2q

Score
7/10
discoveryexecution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-11-15_378c604b0a9cfe2dd772825b919525c1_frostygoop_luca-stealer_snatch.exe" child
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4852
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2072
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2648
      • C:\Windows\system32\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:3044
      • C:\Users\Admin\zxclient\bin\zxcdaemon.exe
        "C:\Users\Admin\zxclient\bin\zxcdaemon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
          PowerShell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\79b7ed3a-3b8d-4cb0-44a8-6c7fdbb0f4f0.ps1
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1724
      • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        PowerShell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\af502731-aad5-4b72-5f5a-9b112feba42d.ps1
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
    Filesize

    3KB

    MD5

    88d931392cd1690707670528a870a69c

    SHA1

    6be74a54f939fcfc499f75f2569f391a4370c388

    SHA256

    9b3a9bc1c1ce01ccbb51c20df3db5fc1a1a6c5fb81f7b9c1e1fadc953bf8c948

    SHA512

    6980e3a207468a1819e4123cbef88d1ee6a900ce837973c26039e34498386c2a8261f65f8487c6b46d9eca93a74a61ce046fa8175dd2f4541fb375e4fe0834c5

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    1KB

    MD5

    b66db53846de4860ca72a3e59b38c544

    SHA1

    2202dc88e9cddea92df4f4e8d83930efd98c9c5a

    SHA256

    b1a00fcea37b39a5556eea46e50711f7713b72be077a73cb16515ca3538d6030

    SHA512

    72eff4ae1d541c4438d3cd85d2c1a8c933744b74c7a2a4830ffe398fee88f1a8c5b241d23e94bcdf43b4be28c2747b331a280a7dc67ab67d8e72c6569f016527

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\79b7ed3a-3b8d-4cb0-44a8-6c7fdbb0f4f0.ps1
    Filesize

    1KB

    MD5

    4df5cc1b534d4f6089704a3a8af7f178

    SHA1

    711af1749044c6746b70fd56553f5ea1b66ef7c0

    SHA256

    217dc67130d8c3447d3628f5b4612b4b65bdee2af87436efecf5ea144c0267b2

    SHA512

    1596c0bcbe5ae54de70b36fc66869b3e9984c7ff67e71b59b4676fa3a19ed9375ab399227ba281166e659cd27cd4846c3d525919b392ab86d831ee2c29a63f28

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxdtmuw1.stg.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\af502731-aad5-4b72-5f5a-9b112feba42d.ps1
    Filesize

    1KB

    MD5

    980011a541a3a563cfc3bfe56b747065

    SHA1

    0a3e95b47306bcc0d487bbdac98f7cda779cb870

    SHA256

    196bc915d0910f5717798db770f8b4972ad1ab659c1d82776c84c746d26c9a2a

    SHA512

    111ef2cdb6a42b4c961793e1fc72a153192aae07a5668e80d687b4c27c397891214868986e2c655b2ade5dbdfb9698379ed37b0c2d8528476742c9bd1a4d2fad

    Download Submit

  • C:\Users\Admin\zxclient\.env
    Filesize

    255B

    MD5

    e715a137939c1b8f6b108a2a1e242a7d

    SHA1

    e0ad1473f3c92d0a47270ef53a42b86d1c0b2607

    SHA256

    4d7b1c3d747117c4132f726e88d63fa764ba179fe41802b84f9ad8f4a22ad217

    SHA512

    da63b6ced8b47741d3995d119f1a5d191b55538a90377f0e9b74d3706db47c358bd5c5c88a630d146931cede8ff5dc3bc87ec4a378d06c55afbe4fb5bacc6b1e

    Download Submit

  • C:\Users\Admin\zxclient\bin\zxcdaemon.exe
    Filesize

    19.9MB

    MD5

    b734999bcf89acf009db13075a44432f

    SHA1

    3f2f157db92865da4323ae0e304cb12eb41edb21

    SHA256

    1bb99f04c07db7d1eb1d20099212a41cc36249fba9c6f558e84a4d8ad5251f81

    SHA512

    a9aedcefb4ebba1716d7807cdec8c0a0183d6585a65cef23dde43db413fb496bf9092db1697c31b525c5c2531610aaf3d045afdb2e582e45eea6055d8d73b47d

    Download Submit

  • memory/2052-26-0x000001E2320E0000-0x000001E232102000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2052-34-0x000001E232110000-0x000001E232118000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2052-33-0x000001E232050000-0x000001E23205A000-memory.dmp

    Filesize

    40KB

    Download