Analysis
-
max time kernel
130s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
14/03/2025, 01:06
General
-
Target
2025-03-14_f154e49cf53a5f16e94fa24b96307efd_frostygoop_gcleaner_poet-rat_sliver_snatch.exe
-
Size
647.4MB
-
MD5
f154e49cf53a5f16e94fa24b96307efd
-
SHA1
e889ddd87a48590db240f532ec083325df42dd27
-
SHA256
82f55f828618106ecd9f1c44acde2f0eefd566d50edcddb1f5782d1af84846c0
-
SHA512
d0e1e2ff2051fc00d8a89b35e9ba494e1ae582774cc1d3907b827b0b0832c288b87767dde371a280a6fd2d7b2049ea4c01cce4cc79e058f8c87d10cabcf67bc1
-
SSDEEP
12582912:Yd3gqIRuCRP7l2YW2gc+wvB0KysQOIcOnv7sWcJYR8i9iu4laWMquR0:UIwCpEB2gCvBgsUcVWcg8hnbm0
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-14_f154e49cf53a5f16e94fa24b96307efd_frostygoop_gcleaner_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-14_f154e49cf53a5f16e94fa24b96307efd_frostygoop_gcleaner_poet-rat_sliver_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C schtasks /create /tn dvrtfBxXgG /tr C:\Users\Admin\AppData\Roaming\dvrtfBxXgG\scjFAgqMDG.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn dvrtfBxXgG /tr C:\Users\Admin\AppData\Roaming\dvrtfBxXgG\scjFAgqMDG.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\dvrtfBxXgG\scjFAgqMDG.exeC:\Users\Admin\AppData\Roaming\dvrtfBxXgG\scjFAgqMDG.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery