Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2025 02:29
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe
Resource
win7-20240903-en
General
-
Target
2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe
-
Size
6.3MB
-
MD5
4693bb147035b175de0478a0d3e90b9b
-
SHA1
00fdb48d88da37beb59013e4c42ed8cc8eb9cb0e
-
SHA256
37ef1e2cd2e1594572abad74d88463ef61179a0e8779b889c3c4364325b2f7c3
-
SHA512
4ec514aa399a799c09dc0cbeb3270a4d2b0d1475705ad7d1c15714aa6803ca154536313b3e8928759ae1c86caf633878e0fef4ee25b88d10cc73417bc891d3c3
-
SSDEEP
49152:ghZhvrCThcGj8J2ILpz8IyMBEGKDEYTEMAQNvbmi5saDCvGpDMTou4ku9C2fXCmw:kHrCuZ2IZDylEavqiNpDMToV9pflN
Malware Config
Extracted
lumma
https://clammyrobiny.cyou/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3748 set thread context of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89 PID 3748 wrote to memory of 4312 3748 2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-19_4693bb147035b175de0478a0d3e90b9b_frostygoop_poet-rat_snatch.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4312
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request68.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request5.114.82.104.in-addr.arpaIN PTRResponse5.114.82.104.in-addr.arpaIN PTRa104-82-114-5deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestclammyrobiny.cyouIN AResponseclammyrobiny.cyouIN A172.67.163.83clammyrobiny.cyouIN A104.21.15.172
-
Remote address:172.67.163.83:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: clammyrobiny.cyou
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=ijkhlh4c7hm4jlvm43ggod1bt6; expires=Wed, 14 May 2025 20:16:41 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
cf-cache-status: DYNAMIC
vary: accept-encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tYZnbFkc2G7t9n5iqu7seH7WJzL4oNsMxJ5qCCc35VGBMxD8FNMpJGkxv37JYIZv7GE%2FNvZJJPszyQcXHxC9bYsAQvwS1f6IBXkkifg5WlRESF3gxOYKcMYe0e5gYQ8zQSm40A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 904366769818459f-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=29170&min_rtt=26082&rtt_var=11377&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3299&recv_bytes=607&delivery_rate=134374&cwnd=253&unsent_bytes=0&cid=71f37d19b0e4cbc4&ts=3318&x=0"
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.163.67.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requeststrivehelpeu.bondIN AResponse
-
Remote address:8.8.8.8:53Requestcrookedfoshe.bondIN AResponse
-
Remote address:8.8.8.8:53Requestimmolatechallen.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststripedre-lot.bondIN AResponse
-
Remote address:8.8.8.8:53Requestgrowthselec.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-deatile.bondIN AResponse
-
Remote address:8.8.8.8:53Requestpain-temper.bondIN AResponse
-
Remote address:8.8.8.8:53Requestjarry-fixxer.bondIN AResponse
-
Remote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A23.214.143.155
-
Remote address:23.214.143.155:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sun, 19 Jan 2025 02:30:03 GMT
Content-Length: 35613
Connection: keep-alive
Set-Cookie: sessionid=7009d5ab41e28be18f47d806; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
-
Remote address:8.8.8.8:53Requestvladimir-ulyanov.comIN AResponse
-
Remote address:8.8.8.8:53Request155.143.214.23.in-addr.arpaIN PTRResponse155.143.214.23.in-addr.arpaIN PTRa23-214-143-155deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request94.65.42.20.in-addr.arpaIN PTRResponse
-
1.0kB 4.9kB 9 9
HTTP Request
POST https://clammyrobiny.cyou/apiHTTP Response
200 -
23.214.143.155:443https://steamcommunity.com/profiles/76561199724331900tls, httpBitLockerToGo.exe1.5kB 43.2kB 21 36
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
68.159.190.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
5.114.82.104.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
63 B 95 B 1 1
DNS Request
clammyrobiny.cyou
DNS Response
172.67.163.83104.21.15.172
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 134 B 1 1
DNS Request
83.163.67.172.in-addr.arpa
-
63 B 128 B 1 1
DNS Request
strivehelpeu.bond
-
63 B 128 B 1 1
DNS Request
crookedfoshe.bond
-
66 B 131 B 1 1
DNS Request
immolatechallen.bond
-
64 B 129 B 1 1
DNS Request
stripedre-lot.bond
-
62 B 127 B 1 1
DNS Request
growthselec.bond
-
64 B 129 B 1 1
DNS Request
jarry-deatile.bond
-
62 B 127 B 1 1
DNS Request
pain-temper.bond
-
63 B 128 B 1 1
DNS Request
jarry-fixxer.bond
-
64 B 80 B 1 1
DNS Request
steamcommunity.com
DNS Response
23.214.143.155
-
66 B 139 B 1 1
DNS Request
vladimir-ulyanov.com
-
73 B 139 B 1 1
DNS Request
155.143.214.23.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
30.243.111.52.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
94.65.42.20.in-addr.arpa