4988ca050932812f03dbb22514cc1297b9adf93154da1f2921733c41aed527d3

Analysis

max time kernel
147s
max time network
162s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/12/2024, 01:50

Target

2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe
Size

633.5MB
MD5

80013dbfa1b6bdb8a3c1f63c3aa87c73
SHA1

7d169cdd59a89d19dba3a83281c36f71bdcd6742
SHA256

4988ca050932812f03dbb22514cc1297b9adf93154da1f2921733c41aed527d3
SHA512

9f3d45be34804e8f9638e9b861a26ff0329ef839c2d5d22d6932d48b3c79b32acc0cb7901372211123d3bcf87fe656ecd958b4b51c0ae1f0d4dca445386cfba4
SSDEEP

12582912:zONJ9mIVf1HbFZOWJcsvSJYlUjUHQzsBfskM3oG8KMlb/gf1f+6j6nksCJMj:AJ9mIXTusvSAPHheY9lzY1fHekh2

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

pid	Process
796	AvgYaKPkRr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvgYaKPkRr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3064	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2132	2840	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2840 wrote to memory of 2132	2840	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2840 wrote to memory of 2132	2840	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2840 wrote to memory of 2132	2840	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	30
PID 2132 wrote to memory of 3064	2132	cmd.exe	32
PID 2132 wrote to memory of 3064	2132	cmd.exe	32
PID 2132 wrote to memory of 3064	2132	cmd.exe	32
PID 2132 wrote to memory of 3064	2132	cmd.exe	32
PID 696 wrote to memory of 796	696	taskeng.exe	35
PID 696 wrote to memory of 796	696	taskeng.exe	35
PID 696 wrote to memory of 796	696	taskeng.exe	35
PID 696 wrote to memory of 796	696	taskeng.exe	35

C:\Windows\system32\taskeng.exe
taskeng.exe {604B9B53-3A9D-489E-9E9A-98BD4C82E82C} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:696
- C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe
  C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:796