Overview

overview

10

Static

static

10

2025-02-17...ch.exe

windows7-x64

1

2025-02-17...ch.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250211-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-02-2025 15:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-17_05e7da3ef1577910dc61a11632e6c8e2_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

  • Size

    10.3MB

  • MD5

    05e7da3ef1577910dc61a11632e6c8e2

  • SHA1

    3e287deba1aad8239a44b6c61c9d8eb5759b211e

  • SHA256

    c23c6c67901468d041cbeb721627dbbc4a1974d6e6ee42a9a3d687ccc1188810

  • SHA512

    42615364144933fe5baacb79bb8a06dc23afad4f502fa4f62824e0342a35216fb081884545a98eded8048491de44b959756bad481673413b48fe034b1bb2d133

  • SSDEEP

    98304:XZ8eBWxO4ujDCTy/8AMujK5I2aFA0rNlHE67:X8OrDCVujK5I23uk67

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-17_05e7da3ef1577910dc61a11632e6c8e2_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-17_05e7da3ef1577910dc61a11632e6c8e2_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-02-17_05e7da3ef1577910dc61a11632e6c8e2_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:3996
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2600
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDNGQjVDOUQtQjFBOS00N0QzLUFDNTItMjJGNkIxQjRFODlDfSIgdXNlcmlkPSJ7RUVBNkE5RDAtMjlEMC00NkI2LUJFQTEtRjk1MjY5NDJFQjEyfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjdCQjIzREUtNzY3OS00OUNBLTk2REEtRjk0RUFEQTdENzU5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mzc2MjI4MjgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
    Filesize

    419KB

    MD5

    ba679291e492df7b43bfffab316a1e79

    SHA1

    8f3a8bf590c52347c614487bd4d99bc0b13144dc

    SHA256

    0ca43c6117cecff443bb2328555244213891981d117b5d363283b8d1ccd925b2

    SHA512

    765ed8ca3b7adf4bad2a1d24fde76ac9218f8bc548eaaca13b1bc455ae9f803ebebcd38adc2364ecc9139e1520b56dcdc522afd8b003c8b7017fb4b89a13f8cb

    Download Submit