dab3d8a9da19a7dff0ef3d3998f71079cd1108f035163e394bf855878b196986

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-22_17492219a6f2b51956f807e9f02be8e1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
Size

5.0MB
MD5

17492219a6f2b51956f807e9f02be8e1
SHA1

a5655edff77158717152b1dda7447247241be6d9
SHA256

dab3d8a9da19a7dff0ef3d3998f71079cd1108f035163e394bf855878b196986
SHA512

09a71ac130bd44cd922d501b48a19021b3ddf52a2a058adc9e4524f6dc7086c8ec14b99e7823cc4f9c52f39c24b024bd1124911ac4b4f674392f83e494542c48
SSDEEP

49152:r56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeXvpnj:r56utgpPFotBER/mQ32lUt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-22_17492219a6f2b51956f807e9f02be8e1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-22_17492219a6f2b51956f807e9f02be8e1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-22_17492219a6f2b51956f807e9f02be8e1_cobalt-strike_cobaltstrike_poet-rat_snatch.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads