Overview

overview

10

Static

static

10

2025-04-12...ch.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    105s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2025, 01:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-12_a8133dab079ce24c46a35749109d8f34_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    9.3MB

  • MD5

    a8133dab079ce24c46a35749109d8f34

  • SHA1

    455ac75b069b855bd3785a0f56d69276b8e83b01

  • SHA256

    c8c36f079915be17e2c725b4247ceca4269e42fa6712f59d90147b103d60251e

  • SHA512

    a57ecbda300a2a92c034177bf70cf441606ae9a68e1d0ec1be032921cea44d5fdfde23c5dfcf10dcc9b97a518b0a31d752fb24b344a5f80c30aa3e20e429ec06

  • SSDEEP

    98304:xn9IO5k+ijWcfaPsLKiyYH+LW0mEfhcEEkzbQT:RBk+ijWVmyYH+i0D52T

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-12_a8133dab079ce24c46a35749109d8f34_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-12_a8133dab079ce24c46a35749109d8f34_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-12_a8133dab079ce24c46a35749109d8f34_frostygoop_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:1744
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:5208

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    4.0MB

    MD5

    8e5f4e35cb17b5bcaddc4e191af9c646

    SHA1

    a1bc80f9cba55a693639ff2c88edbb2650baf708

    SHA256

    e264c4690c30ace1f146607f63dd64bfb329cf048966fb9519e0a2783bcdb180

    SHA512

    a71de54c3c70ceaf2877c097168ec935eed5d58aa2eaed68fd4993ab1e870c46806eb634f84c7b4e38bad003b5db7e4a4cc34e2cd2eeb1857349243e7688e3ab

    Download Submit