626c3199d139fbd3b2d56e67ab5aa21a87c4796c14f2c434d5afd78b8c0adf73

Analysis

max time kernel
149s
max time network
167s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 01:45

Target

2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe
Size

600.1MB
MD5

3d9729705bc8fe0e100c96d03b4891df
SHA1

9b59b630ac39de92c3ef592bdcde8b0703953b33
SHA256

626c3199d139fbd3b2d56e67ab5aa21a87c4796c14f2c434d5afd78b8c0adf73
SHA512

3c71480e02327cd2051a80690dfae22d7c3c83f543d2bd14874004d95373317e69d4a051bff35deaa881a6f959b144db0932330a7bee5afd7288d265a7ef0965
SSDEEP

12582912:RJVj5uX9Wx79hP0ALAEncYkTZ/ee4P87coh+rh+K3dq:EA5cYkTZ/kPpomh+sdq

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

pid	Process
2692	AvgYaKPkRr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvgYaKPkRr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2848	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2160	2260	2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2260 wrote to memory of 2160	2260	2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2260 wrote to memory of 2160	2260	2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2260 wrote to memory of 2160	2260	2024-12-17_3d9729705bc8fe0e100c96d03b4891df_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2160 wrote to memory of 2848	2160	cmd.exe	32
PID 2160 wrote to memory of 2848	2160	cmd.exe	32
PID 2160 wrote to memory of 2848	2160	cmd.exe	32
PID 2160 wrote to memory of 2848	2160	cmd.exe	32
PID 2584 wrote to memory of 2692	2584	taskeng.exe	34
PID 2584 wrote to memory of 2692	2584	taskeng.exe	34
PID 2584 wrote to memory of 2692	2584	taskeng.exe	34
PID 2584 wrote to memory of 2692	2584	taskeng.exe	34

C:\Windows\system32\taskeng.exe
taskeng.exe {4DCF9C8C-F53A-49F4-A36A-9E8C94E6672D} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe
  C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2692