Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-11-2024 01:26
General
-
Target
2024-11-18_29b9a3177286d75c54c2b5e47c9eae0a_frostygoop_poet-rat_snatch.exe
-
Size
7.2MB
-
MD5
29b9a3177286d75c54c2b5e47c9eae0a
-
SHA1
bd9e461f79fa739d9ec4882fba0ad970d990dca6
-
SHA256
0b73f3f47424d3a84d8fe9eda96b3e860d8004d60070a328d22ab82d0b68a3ef
-
SHA512
76fd106fe9ea66841f66b1e85301f922635f69af3c03ac4a3b62a4b94fbf07058129dc8488cc333e30b1b8e6ae1426be5c55980d8ae96cce542ebed286251f68
-
SSDEEP
98304:R+8WZoZY1nliyx2v9yfZrM2n8XEmFasiw7vJnmJGxJpJPM9Gj:uZJNU6BrM2ncFaRsZxbJPR
Malware Config
Signatures
-
XMRig Miner payload 2 IoCs
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-18_29b9a3177286d75c54c2b5e47c9eae0a_frostygoop_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-18_29b9a3177286d75c54c2b5e47c9eae0a_frostygoop_poet-rat_snatch.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cloudb.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cloudb.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\Temp\golang-updater.exeC:/windows/Temp/golang-updater.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD5201127bcc5d2c9c80506f3a764854aad
SHA194732cf4b8506b7d4c915123103017c16b82be6b
SHA2564256c72eabdc5e2e4619ab42a4a7e9e638477a5507555971376e0ca1b2a3779b
SHA512adfe60f72e89317381347f7f7ff963c7f4a4eb881e54a7baa78a86a5440db7f0c1e74b50e8e4111332891833befbdc4a4906ba3364287789bfca90f0f3074e19
-
Filesize
5.5MB
MD54055c2f21690a86aa71ddd9ce4aa5112
SHA15346ee531ae5b75651a3bdc3a26b5434a1894faa
SHA256aff7e5faf63d3d1571b7b166e2423dcd287ca8f6c3afffa68c74be148981115e
SHA512f60eaf7d27a62fe6a5b0acf53551e0c4d71ff01f1aa43f3256430e72ec85d2c255539679e58b334cfc5a2319b6420ddeb73597a4e9f7ffc083d393a3a8fe40bb
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB