poisonivy | eb84360ca4e33b8bb60df47ab5ce962501ef3420bc7aab90655fd507d2ffcedd

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lab03-01.exe
Size 7KB
Sample261002-fbakbshb94
SHA256 eb84360ca4e33b8bb60df47ab5ce962501ef3420bc7aab90655fd507d2ffcedd
MD5 d537acb8f56a1ce206bc35cf8ff959c0
SHA1 0bb491f62b77df737801b9ab0fd14fa12d43d254
SHA512 02ce7f2db5d0d667c8367f00026a30c61b117fd46b3b25832cfef573cf9929f3d2fbfa2ad6b25a4c2e62c92a016006951e856e7b8b2be7c2a110886111af1bbb
SSDEEP 192:OJGc1Zl2+VAfNxl1THs6xgzgVGjPlRkTnQAx:OJGcMJxDTHfRmap
TLSH
T17CE10989F301DE96C5214A357392CB22EA6AC878B74B7747F6D00B9130F56B5E61E883
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery poisonivy rat

Malware Config

Signatures

Family: PoisonIvy
PoisonIvy is a remote access trojan used by many threat actor groups, first seen in 2005.
rat poisonivy

Detects PoisonIvy RAT 1 IoCs

resource	yara_rule
behavioral1/memory/3472-0-0x0000000000400000-0x0000000000401C00-memory.dmp	family_poisonivy

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3060	3472	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lab03-01.exe

C:\Users\Admin\AppData\Local\Temp\Lab03-01.exe
"C:\Users\Admin\AppData\Local\Temp\Lab03-01.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 488
  2⤵
  - Program crash
  PID:3060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3472 -ip 3472
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3472-0-0x0000000000400000-0x0000000000401C00-memory.dmp

Download