Analysis
-
max time kernel
153s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
10/03/2025, 19:44
General
-
Target
2025-03-10_d2713f2300bc5f0e0620f5dc6ed98c64_frostygoop_poet-rat_sliver_snatch.exe
-
Size
752.3MB
-
MD5
d2713f2300bc5f0e0620f5dc6ed98c64
-
SHA1
076502c3cc3295de52c082208d7ad07c20528095
-
SHA256
99f6b4ad406817a1047b99d684aa32639e64c3501a5875d2f5cb7a0bd15bec1a
-
SHA512
ded62c7496170bc84e3de7b7210235a815b87b22c0e6ce7c0599ac11989bb4737cd41ea2166fea3ef4b992ad3621a24722a887308557b0ba9ef07a70ade3af5b
-
SSDEEP
12582912:U43uMDW30BOAaohUsCbtBr2oZk09rj2tg6uBUY+/6BYIXuhyH4UIa9tcYkkcgoUf:umOems+rjjqLuBxFYIl4z+tcYk+3f
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-10_d2713f2300bc5f0e0620f5dc6ed98c64_frostygoop_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-10_d2713f2300bc5f0e0620f5dc6ed98c64_frostygoop_poet-rat_sliver_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn xbZstzVdno /tr C:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn xbZstzVdno /tr C:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exeC:\Users\Admin\AppData\Roaming\xbZstzVdno\KhqSZFQxEb.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery