Overview

overview

10

Static

static

10

2025-03-02...ch.exe

windows7-x64

1

2025-03-02...ch.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    141s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2025, 01:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-02_37c310c0b6a96543a2457d5d3df100a5_frostygoop_golang_luca-stealer_poet-rat_sliver_snatch.exe

  • Size

    14.7MB

  • MD5

    37c310c0b6a96543a2457d5d3df100a5

  • SHA1

    e34f3701aebc8e4a0711e230ae11e10df5b1c682

  • SHA256

    a613ba091bc25535b066c9b3ffa6c809cc2e981634c916a23b38b6c8402729fb

  • SHA512

    c31b746731c2726b299fd36656dd1578daa6fa7f2bb301709a381785b3833d5b2e5632a43b44034c8deb0fec4f0c6a2c7bcebd0e85004b9ef11f94ab9b4fd5d6

  • SSDEEP

    196608:Gcj8C4Fu4W7YRpzBT74JmeVPQrWF06TRf:dL4FupU74JPV4rO0+

Score
9/10
defense_evasionexecution

Malware Config

Signatures

  • Enumerates VirtualBox DLL files 2 TTPs 10 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Identifies Xen via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Looks for Parallels drivers on disk. 2 TTPs 6 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 4 IoCs
    defense_evasion
  • Looks for VirtualBox executables on disk 2 TTPs 3 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 7 IoCs
    defense_evasion
  • Looks for Xen service registry key. 1 TTPs 5 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry 3 TTPs 5 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-02_37c310c0b6a96543a2457d5d3df100a5_frostygoop_golang_luca-stealer_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-02_37c310c0b6a96543a2457d5d3df100a5_frostygoop_golang_luca-stealer_poet-rat_sliver_snatch.exe"
    1⤵
    • Enumerates VirtualBox DLL files
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Identifies Xen via ACPI registry values (likely anti-VM)
    • Looks for Parallels drivers on disk.
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VirtualBox drivers on disk
    • Looks for VirtualBox executables on disk
    • Looks for VMWare Tools registry key
    • Looks for VMWare drivers on disk
    • Looks for VMWare services registry key.
    • Looks for Xen service registry key.
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Checks system information in the registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\explorer.exe
      explorer C:\Users\Admin\AppData\Local\Temp\preview_2.mp4
      2⤵
        PID:3388
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4140
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3512
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\preview_2.mp4"
        2⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1708
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x244 0x504
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1960

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      223bd4ae02766ddc32e6145fd1a29301

      SHA1

      900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

      SHA256

      1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

      SHA512

      648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      071e40c48b137a5d464968fcac2ed5f9

      SHA1

      26d7916861ada434d4457569055aeffebb2e1617

      SHA256

      96127b0d042da66bf8332ddd5a22ba4046c47fa2306d18319c22097560d28f5e

      SHA512

      8d6d81091f04e06c3c4562f606d3b3ab2d3ecf015d8f6c0ac75b1477450aaa3d98b7ddf79b682ff69c3fef1c109443a8cb23d257442cff6d0bcb575cb6c0e67e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_viso2pk1.4yz.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\preview_2.mp4
      Filesize

      1.4MB

      MD5

      2117911eeea43985a4ad5b5610dbabab

      SHA1

      b52f696309d1bae96292e7ff78d5846d66ca4cfa

      SHA256

      d8989c44587e62deb19e775b7cc1bff4226ff616811237dce51cecf92fcdc8b7

      SHA512

      ad30a728fdd8f2dca58956495e117520ddb88bfd7afe633f272c0230801b70bd24eea22a11112e5f2e638d8f3dd64629bc0f36d0736d9ee13fb60e839c64b1b5

      Download Submit

    • memory/1708-36-0x00007FFEE0BC0000-0x00007FFEE0BD1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1708-34-0x00007FFEE5980000-0x00007FFEE5998000-memory.dmp

      Filesize

      96KB

      Download

    • memory/1708-31-0x00007FF6874D0000-0x00007FF6875C8000-memory.dmp

      Filesize

      992KB

      Download

    • memory/1708-35-0x00007FFEE4510000-0x00007FFEE4527000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1708-39-0x00007FFEE0390000-0x00007FFEE03AD000-memory.dmp

      Filesize

      116KB

      Download

    • memory/1708-40-0x00007FFEE0370000-0x00007FFEE0381000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1708-41-0x00007FFED0510000-0x00007FFED071B000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/1708-33-0x00007FFED0B60000-0x00007FFED0E16000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/1708-38-0x00007FFEE03B0000-0x00007FFEE03C1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1708-37-0x00007FFEE04E0000-0x00007FFEE04F7000-memory.dmp

      Filesize

      92KB

      Download

    • memory/1708-87-0x000001A8E72F0000-0x000001A8E8B5F000-memory.dmp

      Filesize

      24.4MB

      Download

    • memory/1708-32-0x00007FFEE03D0000-0x00007FFEE0404000-memory.dmp

      Filesize

      208KB

      Download

    • memory/1708-48-0x00007FFEDF6B0000-0x00007FFEDF6C1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1708-47-0x00007FFEDFE00000-0x00007FFEDFE11000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1708-46-0x00007FFEDFE20000-0x00007FFEDFE31000-memory.dmp

      Filesize

      68KB

      Download

    • memory/1708-45-0x00007FFEDFE40000-0x00007FFEDFE58000-memory.dmp

      Filesize

      96KB

      Download

    • memory/1708-44-0x00007FFEE0010000-0x00007FFEE0031000-memory.dmp

      Filesize

      132KB

      Download

    • memory/1708-43-0x00007FFEE0060000-0x00007FFEE00A1000-memory.dmp

      Filesize

      260KB

      Download

    • memory/1708-42-0x00007FFECF460000-0x00007FFED0510000-memory.dmp

      Filesize

      16.7MB

      Download

    • memory/1708-49-0x000001A8E72F0000-0x000001A8E8B5F000-memory.dmp

      Filesize

      24.4MB

      Download

    • memory/1708-52-0x00007FFED0B60000-0x00007FFED0E16000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/1708-71-0x00007FFED0B60000-0x00007FFED0E16000-memory.dmp

      Filesize

      2.7MB

      Download

    • memory/1708-80-0x00007FFECF460000-0x00007FFED0510000-memory.dmp

      Filesize

      16.7MB

      Download

    • memory/4140-2-0x000001BB1E930000-0x000001BB1E952000-memory.dmp

      Filesize

      136KB

      Download