Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/12/2024, 01:56
Behavioral task
behavioral1
Sample
2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe
-
Size
4.6MB
-
MD5
dbafcba849e3702adefa9552bae860f4
-
SHA1
175e356348d0645ee461f4069812ba736cd1edeb
-
SHA256
0fc6c03f42ecb88fcfc3ea2973ee39c2f361fbec70c0085eb5892476b7210504
-
SHA512
3dc7c7d9e90bc1f34a4203cf0da7fa6e1223323bbf55054bb57fa5510a21507e5488a9e2ee5ba6058ccb7d9c33ec3fabb9245d02a41561619b1d9a6da268b7e0
-
SSDEEP
49152:hP7FEYi0KG0ZzpyZ9vAaE5FKY/t76oUz70g/YOKyjrbsnnzvS/9rMXB/GZPj1zn3:B5E/VVyZpoUzh/LsnzhmdXOY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1004 AvgYaKPkRr.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvgYaKPkRr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4536 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3992 wrote to memory of 4532 3992 2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe 83 PID 3992 wrote to memory of 4532 3992 2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe 83 PID 3992 wrote to memory of 4532 3992 2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe 83 PID 4532 wrote to memory of 4536 4532 cmd.exe 85 PID 4532 wrote to memory of 4536 4532 cmd.exe 85 PID 4532 wrote to memory of 4536 4532 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-17_dbafcba849e3702adefa9552bae860f4_frostygoop_poet-rat_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn HSzoORFply /tr C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn HSzoORFply /tr C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4536
-
-
-
C:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exeC:\Users\Admin\AppData\Roaming\HSzoORFply\AvgYaKPkRr.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1004