Overview

overview

10

Static

static

10

2025-04-13...ch.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    103s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/04/2025, 11:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.3MB

  • MD5

    e80a935708de68867ead4bb0970a1cb6

  • SHA1

    caa4a3e54c849a1c8cb8e095e2f022942a9d5410

  • SHA256

    4c62630d86e3a8989ab9167a21822e686b9559e55421a1c779ad05eccfc6c908

  • SHA512

    d56f447971d9605491366d3e15fb264ff5a8b722a9fbc3d0e172ce7386b263b6f3a4a654f59e26bcccf0fbdc70a499500cc5e5363218d16e08deb3b7e3a7914b

  • SSDEEP

    98304:AkbS4GeZk9WMOfpgu+NsFUqNEXzR/wLA0rn7QEMb:Ad4dZkFu+NsyCEXzR/wcypMb

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5416
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-13_e80a935708de68867ead4bb0970a1cb6_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:2992
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:4380

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    4.6MB

    MD5

    d0090bd8e148724a94412f500ad5c10f

    SHA1

    367b7ea451a6f32c01ee89ca2662c4443df51082

    SHA256

    d62ae81f90ce98429b4dac793cd5c9ff2e6e2d4cbeb1b53ec6d432053b95ac2d

    SHA512

    029af50e882d5aca3adb6f03976354acbf353d5420f243f04c7adb2948d9c9a1b1791336e9adc9114db5183d9a17d396ea928e84cab16e65b5731f96d6c7f898

    Download Submit