Analysis
-
max time kernel
103s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/04/2025, 20:36
General
-
Target
2025-04-14_650a6bc4d146348a883c33f0718865b5_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
-
Size
10.3MB
-
MD5
650a6bc4d146348a883c33f0718865b5
-
SHA1
4f4f6d242ec72e038d3bb8635f0b03108f8a63b2
-
SHA256
a05bd87a2506e3a4b40be2d7e6d1b63ae3c4cb9ed61bd0f82bae5fbf1c8e5b77
-
SHA512
5f088e5e5a1b9480343fa08f90091fe3fc42e9c1dea6a4fada037fe61b5bbd9706828189e3af3e1a750769ca458b3c38ce68bbfe3a2e7459f33dbe612e34ba30
-
SSDEEP
98304:xkbS4GeZk9WMOfpgu+NsFUqNEXIR/wLA0rn7QEMb:xd4dZkFu+NsyCEXIR/wcypMb
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-14_650a6bc4d146348a883c33f0718865b5_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-14_650a6bc4d146348a883c33f0718865b5_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-14_650a6bc4d146348a883c33f0718865b5_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx