General
-
Target
2024-11-19_e83fa1c4d6f42821037608ba6c3c7b14_frostygoop_luca-stealer_poet-rat_snatch
-
Size
5.0MB
-
Sample
241119-r1wpmsskap
-
MD5
e83fa1c4d6f42821037608ba6c3c7b14
-
SHA1
34e76923d3500251a84ef86f43d913d2aaed10ee
-
SHA256
e316dc3870d3aed2d2330fe74225fabbdd8d5206d1a785713215b668720f12e8
-
SHA512
22f1c2ebbc5a154722a27707c03a7185d5ef610a82bb5cbc1e3153a56e5a7a799520f0cca2920acd290724e58556bddaa918ffb28311cbfd16bb23e9e198fa6e
-
SSDEEP
49152:OgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGlJS5Zi:J4e4uPpVm6gTVGIO7DfEa+e7
Static task
static1
Behavioral task
behavioral1
Sample
2024-11-19_e83fa1c4d6f42821037608ba6c3c7b14_frostygoop_luca-stealer_poet-rat_snatch.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-19_e83fa1c4d6f42821037608ba6c3c7b14_frostygoop_luca-stealer_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
meshagent
2
TacticalRMM
http://mesh.pl.promled.info:443/agent.ashx
-
mesh_id
0x69ACC085A7BD213D881483D557B7FA209FA0AA180A06263277FB50D4835A587A2DB02E382246530A11536B07F1588A98
-
server_id
AFA97A19F77BE549024E0CD3EC628FA4E76B82C750F4571A6506FA5987B1E85368666413E577F70FF492E2558DB44895
-
wss
wss://mesh.pl.promled.info:443/agent.ashx
Targets
-
-
Target
2024-11-19_e83fa1c4d6f42821037608ba6c3c7b14_frostygoop_luca-stealer_poet-rat_snatch
-
Size
5.0MB
-
MD5
e83fa1c4d6f42821037608ba6c3c7b14
-
SHA1
34e76923d3500251a84ef86f43d913d2aaed10ee
-
SHA256
e316dc3870d3aed2d2330fe74225fabbdd8d5206d1a785713215b668720f12e8
-
SHA512
22f1c2ebbc5a154722a27707c03a7185d5ef610a82bb5cbc1e3153a56e5a7a799520f0cca2920acd290724e58556bddaa918ffb28311cbfd16bb23e9e198fa6e
-
SSDEEP
49152:OgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGlJS5Zi:J4e4uPpVm6gTVGIO7DfEa+e7
-
Detects MeshAgent payload
-
Meshagent family
-
Blocklisted process makes network request
-
Sets service image path in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1