ae106d2d90b77fa8f42929ac1d91fdc0b7c1745600b2f7794f8c0cdf87b45205

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Size

9.9MB
MD5

36ebf1f68d9bb05ac0de57d441874305
SHA1

ef038fb32cc372654ee55ba71b4e10fe082d8b17
SHA256

ae106d2d90b77fa8f42929ac1d91fdc0b7c1745600b2f7794f8c0cdf87b45205
SHA512

f4b621eb51a1d657cd9c83b8658b6559291b5cbd1f67553026a93107109fdb0568a485cf52ee18f6fd73806aa6abfb9b146d683f0c07e55832de3390e1c201d9
SSDEEP

98304:Ph+95Wv63mv4CjBKFM5VTepvEsnBzEID2gCZmCz:J+063mAnSTepvTBgTvz

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

description	pid	Process
Token: SeDebugPrivilege	4836	2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

description	pid	Process	procid_target
PID 4836 wrote to memory of 3496	4836	2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	84
PID 4836 wrote to memory of 3496	4836	2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	84

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
3496	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-11-27_36ebf1f68d9bb05ac0de57d441874305_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads