Overview

overview

10

Static

static

10

2025-04-14...ch.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    103s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/04/2025, 05:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-14_79eec308b05540e1525c0ec760566bb8_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.3MB

  • MD5

    79eec308b05540e1525c0ec760566bb8

  • SHA1

    3669651c41161d98fa352f0c7ecb3da6ba90b6ea

  • SHA256

    425b2febecab60a8b54a7296e304b5499c2afcccf6090cce3bb12396c35581d1

  • SHA512

    6eb7f2968e56306a19f569d3f827851e19d0504dd83cf66629c2cf252e056251d40d97fdededc12ad81c651925a0bbb52b0a4e8571b7c15d0dadc810ef67b16c

  • SSDEEP

    98304:HkbS4GeZk9WMOfpgu+NsFUqNEX0R/wYA0rn7jEMb:Hd4dZkFu+NsyCEX0R/w7ywMb

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-14_79eec308b05540e1525c0ec760566bb8_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-14_79eec308b05540e1525c0ec760566bb8_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-14_79eec308b05540e1525c0ec760566bb8_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:5736
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    PID:5200

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    4.0MB

    MD5

    778a46cb358f5546d650c02207557363

    SHA1

    1e1899aa68cb9baddcbbbe273a4b8d2cfd670898

    SHA256

    ff990f10e74209b92cf2957ebfb42a0a78844cec3339f82ac1cf42a8e5fc9206

    SHA512

    2e66c2bbc31b4954e4d0f0ae481723906cfdc8255885e907e05c5847d37cf62fc7fe330d4e939bda2a7cae32e03705a9a5ea49aaef5e74116221001c46b1f529

    Download Submit