Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
10/03/2025, 19:34
General
-
Target
2025-03-10_5f4ef6304cb9a61dda50aedf6b8c610f_frostygoop_poet-rat_sliver_snatch.exe
-
Size
4.6MB
-
MD5
5f4ef6304cb9a61dda50aedf6b8c610f
-
SHA1
22f8650d837639d5111458bef3c1f2452f4e7ca1
-
SHA256
a6b21c396a5e0875875732d93d048176cf9ad78e34e8a08615590bcd90714c96
-
SHA512
a9b9afd3da4520af570df62cecdc8e9e6b31730a71b13fd1ce7f681667be4f5774358cebd7126c3efe39ea8b101f24e39795b91507f936c392e5c44d2548446d
-
SSDEEP
49152:X/7Fss80KlU0zp+Z9vAaE5FKY/t76oUzrUA/AOiyjrbsn3zvSn9rMPN/u9Mj9ln6:v5sVPV+ZpoUzp/Tknj5BaXOY
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-10_5f4ef6304cb9a61dda50aedf6b8c610f_frostygoop_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-10_5f4ef6304cb9a61dda50aedf6b8c610f_frostygoop_poet-rat_sliver_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn xbZstzVdno /tr C:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn xbZstzVdno /tr C:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exeC:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery