4988ca050932812f03dbb22514cc1297b9adf93154da1f2921733c41aed527d3

Analysis

max time kernel
152s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2024, 01:50

Target

2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe
Size

633.5MB
MD5

80013dbfa1b6bdb8a3c1f63c3aa87c73
SHA1

7d169cdd59a89d19dba3a83281c36f71bdcd6742
SHA256

4988ca050932812f03dbb22514cc1297b9adf93154da1f2921733c41aed527d3
SHA512

9f3d45be34804e8f9638e9b861a26ff0329ef839c2d5d22d6932d48b3c79b32acc0cb7901372211123d3bcf87fe656ecd958b4b51c0ae1f0d4dca445386cfba4
SSDEEP

12582912:zONJ9mIVf1HbFZOWJcsvSJYlUjUHQzsBfskM3oG8KMlb/gf1f+6j6nksCJMj:AJ9mIXTusvSAPHheY9lzY1fHekh2

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

pid	Process
2828	AvgYaKPkRr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvgYaKPkRr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3004	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3720	1212	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	86
PID 1212 wrote to memory of 3720	1212	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	86
PID 1212 wrote to memory of 3720	1212	2024-12-17_80013dbfa1b6bdb8a3c1f63c3aa87c73_frostygoop_poet-rat_sliver_snatch.exe	86
PID 3720 wrote to memory of 3004	3720	cmd.exe	88
PID 3720 wrote to memory of 3004	3720	cmd.exe	88
PID 3720 wrote to memory of 3004	3720	cmd.exe	88