ca048c463dcdf91e84ddc260bc0cadb6b0d8a68f92dc527c4038f7a6ab7c32b4

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Size

14.8MB
MD5

f455be9af5edfdb2a3ea974d743f91b6
SHA1

8a4bab4f65c3b1c54f58786c67d94f900e5cd0b0
SHA256

ca048c463dcdf91e84ddc260bc0cadb6b0d8a68f92dc527c4038f7a6ab7c32b4
SHA512

98248a6e03084b7df36bbdca5cc0d0d01ad5f4d83a86fb9d6235d8b692bafeaee0c361b905a05289e91457b829d2cc9a3afe28516c7b84387e3710891ea1db1c
SSDEEP

196608:+itOI01DSfgMh0DVL6MzfCmMIEtVzxHejiO9rMyORk:+iUI4DYoLjCVtthxHdyOi

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1164	4812	2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	83
PID 4812 wrote to memory of 1164	4812	2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	83

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1164	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2024-12-24_f455be9af5edfdb2a3ea974d743f91b6_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads