0c6ca8bee1ae329129634711d53356bf7bd13f86b9e68140dc5dd664f1f8c08c

Analysis

max time kernel
116s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
Size

14.4MB
MD5

6be16213afc8338890849064fe2a8a97
SHA1

bf6bd4dcfa44d09ff37552696eeba89b5b222f73
SHA256

0c6ca8bee1ae329129634711d53356bf7bd13f86b9e68140dc5dd664f1f8c08c
SHA512

3524629bfea2df4be81e6d8644301abdbdb90abb163d196eba2f0755b6d457b0cddbfe4acf8e12662df94420e755a641ae3de4ea2340edf52a18b6cda4cb867b
SSDEEP

196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRqhRYhRkhRBhRWhRohRBhRKhRf:DAkLRLRxRYR+RkR4RLRCR0RLReRf

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgTNlSoh = "c:\\Windows\\System32\\sgTNlSoh.exe"	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QpDTZPw = "c:\\Windows\\System32\\QpDTZPw.exe"	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVrKjcMU = "c:\\Windows\\System32\\NVrKjcMU.exe"	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\desktop.ini	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\sgTNlSoh.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	\??\c:\Windows\System32\QpDTZPw.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	\??\c:\Windows\System32\NVrKjcMU.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square150x150Logo.scale-125.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\office.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppSettingsCppCX.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Date.targetsize-32_contrast-white.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-20.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Northwoods.Go.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_contrast-black.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\3DViewerProductDescription-universal.xml	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\e_sqlite3.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionWideTile.scale-200.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageWideTile.scale-100.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SimpleProgressBarTheme.xbf	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-24.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\GetHelpOffline2.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\clrcompression.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-16.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-200.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60_altform-unplated_contrast-white.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-125.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-250.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Camera_Capture.m4a.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\PopConvert.lnk	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\SmallTile.scale-125.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\8.rsrc.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\osfproxyimm.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\TimeBackground.dll.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-100.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-unplated_contrast-white.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-20_altform-lightunplated.png.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-100.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.exe	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-400.png	2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-25_6be16213afc8338890849064fe2a8a97_poet-rat_sliver_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
15.1MB

MD5
04c0122f6f193f9fcf4c99ea651730fa

SHA1
3bd164d3f72553a7ca13cfeb13363e7ecdea810e

SHA256
2da3f50215bd5dc978dc13585ab4831c2853fa17d0f377cf47bd102df56c6221

SHA512
0e2540d5fa7551098579a9d0d8f7536a2296c592d14f4ec3ad7bca906f7579b65975f316424e3a3f2e5f15a718659d6d84b21b79f281aa37fe664502dbb879a3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads