Analysis
-
max time kernel
105s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
18/04/2025, 22:40
General
-
Target
2025-04-18_d8aa48e2d8b8bbb5fc9579866accfe00_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
-
Size
10.3MB
-
MD5
d8aa48e2d8b8bbb5fc9579866accfe00
-
SHA1
fb5492d7fe655199f810be4c50eea29023de8058
-
SHA256
93643f6f0cea3ea34541a532b1d5acc89bd68a31975a96a7275e2d50c5ba13d8
-
SHA512
e24985258dbe52126489e5ebd4e5b18bf55b8d58916b40deba8d5eaad1c3fe5183d6a5368cc725e228ddb89a8c01ab106f765886510ec60784b9d45cd12116ea
-
SSDEEP
98304:CaSL8bZv/NL61NxiEvVbE/8CERB6O5wCA0rRxEmb:Cobl/NUvVbEEfRB6O5wFMSmb
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-18_d8aa48e2d8b8bbb5fc9579866accfe00_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-18_d8aa48e2d8b8bbb5fc9579866accfe00_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-18_d8aa48e2d8b8bbb5fc9579866accfe00_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx