0fc6c03f42ecb88fcfc3ea2973ee39c2f361fbec70c0085eb5892476b7210504

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 01:56

Target

2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe
Size

4.6MB
MD5

dbafcba849e3702adefa9552bae860f4
SHA1

175e356348d0645ee461f4069812ba736cd1edeb
SHA256

0fc6c03f42ecb88fcfc3ea2973ee39c2f361fbec70c0085eb5892476b7210504
SHA512

3dc7c7d9e90bc1f34a4203cf0da7fa6e1223323bbf55054bb57fa5510a21507e5488a9e2ee5ba6058ccb7d9c33ec3fabb9245d02a41561619b1d9a6da268b7e0
SSDEEP

49152:hP7FEYi0KG0ZzpyZ9vAaE5FKY/t76oUz70g/YOKyjrbsnnzvS/9rMXB/GZPj1zn3:B5E/VVyZpoUzh/LsnzhmdXOY

Score

7^/10

discovery

Executes dropped EXE 1 IoCs

pid	Process
2684	AvgYaKPkRr.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AvgYaKPkRr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2952	schtasks.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 616	2120	2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe	32
PID 2120 wrote to memory of 616	2120	2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe	32
PID 2120 wrote to memory of 616	2120	2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe	32
PID 2120 wrote to memory of 616	2120	2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe	32
PID 616 wrote to memory of 2952	616	cmd.exe	34
PID 616 wrote to memory of 2952	616	cmd.exe	34
PID 616 wrote to memory of 2952	616	cmd.exe	34
PID 616 wrote to memory of 2952	616	cmd.exe	34
PID 2776 wrote to memory of 2684	2776	taskeng.exe	36
PID 2776 wrote to memory of 2684	2776	taskeng.exe	36
PID 2776 wrote to memory of 2684	2776	taskeng.exe	36
PID 2776 wrote to memory of 2684	2776	taskeng.exe	36

C:\Windows\system32\taskeng.exe
taskeng.exe {9565D415-C3FD-452C-98E6-4B2632AA02A6} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe
  C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2684