8daa9f2226a8ebe550f05cfcc62aa874141a6b7ded1ede567d89ba3f5b5d1b61

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2025 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
Size

12.0MB
MD5

a8a2bf605471ce7efcd4079c7bd1c025
SHA1

af22d6f0001caf435c4400dab951e268aba928d9
SHA256

8daa9f2226a8ebe550f05cfcc62aa874141a6b7ded1ede567d89ba3f5b5d1b61
SHA512

43146c9a12243a5af7400ffce177440ec529642e397b00cb9c8ff85dd381bbdd4b75462d546e745c45dd9418a0e2496113253f2c5991560ae1d6458bc5cc5207
SSDEEP

196608:I+D5q1SGs2yRwtkpqShRBhR3hRMhRbhRKhRuhRqhR1hRLhR8:DAkLRLRxRwRtReRKR+R3RdR8

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iSqRAYK = "c:\\Windows\\System32\\iSqRAYK.exe"	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DzkEpO = "c:\\Windows\\System32\\DzkEpO.exe"	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bqgTfBq = "c:\\Windows\\System32\\bqgTfBq.exe"	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\desktop.ini	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\iSqRAYK.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	\??\c:\Windows\System32\DzkEpO.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	\??\c:\Windows\System32\bqgTfBq.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxManifest.xml	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\SmallTile.scale-100.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-150.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-125.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_contrast-black.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Planet.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-400.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-300.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ro-RO\View3d\3DViewerProductDescription-universal.xml.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-150.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\System\FM20ENU.DLL.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-400.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyVideoProjectCreations_DarkTheme.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\SplashScreen.scale-125.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxComm.dll.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\THMBNAIL.PNG.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-lightunplated.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-125.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\moe_default_icon.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-200.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-file-l2-1-0.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-250.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAI.TTF.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Diagram.jpg.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-GB\tokens_enGB.xml	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-200.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.jpg.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-100.png	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\msapp-error.js	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-200.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-40.png.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat.exe	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll	2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-02-18_a8a2bf605471ce7efcd4079c7bd1c025_poet-rat_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
12.7MB

MD5
640ae8b9c90b93c03ebbbb25da2d1e23

SHA1
906479ab1d97e1f4ba8bdb1cfa46bb3b2cdd47e1

SHA256
de52552a7f4be049de0af0a99b105a9aaea8cdadadab041e8cc592ef9d4a46ab

SHA512
21c39e661aa592fbf8d03ab3e768d17ae08cad9214fa7bb10d56bd767168ddd4eb14e4bed69694398167cd54e7975454f9f395f43e09743517bab52b0ca61c24

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads