Overview

overview

10

Static

static

3

2025-04-20...ch.exe

windows10-2004-x64

10

2025-04-20...ch.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    100s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/04/2025, 22:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe

  • Size

    10.3MB

  • MD5

    ceef5ed46adabf633d4475585bc179c3

  • SHA1

    b3bcadd9d8c718b8cdcfa5041b4536fd9d40177e

  • SHA256

    b7903a40c0e842844a520e7a83dc75afb8a149138fa1f7660ca60b3a2d3446ec

  • SHA512

    b39b368f8fefdad0fecaae400acb21542940ae0752eba65fe832993e5c98bdbe806508792b48b9d7ca5812fcba2ff9da9997ad234573e80402d12708858ed682

  • SSDEEP

    98304:JweCb+Tm9b6V+eOAyfVracl+A9rUhUheEEbPhhlxa:JrCbMm9QOAyfVWcl5dbEbJ

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\system32\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Local\Temp\2025-04-20_ceef5ed46adabf633d4475585bc179c3_frostygoop_knight_luca-stealer_ngrbot_poet-rat_sliver_snatch.exe
      2⤵
      • Views/modifies file attributes
      PID:1208
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:5016

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
    Filesize

    4.2MB

    MD5

    b82687c016aa0b2a8670a890c9f26153

    SHA1

    3b632adfe4f4c02452af5d16a50d6afec1d7206e

    SHA256

    cf7c5862b10cf3b0a6cfe04c17f9ff6108aed67f91f67cd5cc306e237a3a428f

    SHA512

    10974fba15a3564fb17988265c50652cdb355b5972ce6cbb3db981b3312152ac2e9226ad7c92a047ef4498b8cedc06a0330bc0d7790dcdb73a8a6ba5384633e3

    Download Submit