File name:

2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch

Full analysis: https://app.any.run/tasks/90b227a5-2b11-4657-b18c-d501b4b23b54
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 18, 2025, 03:10:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
golang
loader
websocket
exfiltration
meshagent
ip-check
arch-exec
arch-scr
arch-doc
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, 7 sections
MD5:

3EB16BFE589FA8EEDE0D65E4EAA97AF7

SHA1:

50AA35104C75E11303A3196D580BA56F6527AB18

SHA256:

DB8E872638FA6E88EAD099D9534B38485E368FD6FAF91D46CC1D5281646CFDDD

SSDEEP:

98304:Unz9agBgXP7aOhkedjIT4ZSCXy13YQau6qW:y2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 6384)
      • cmd.exe (PID: 7008)
      • net.exe (PID: 7156)
      • cmd.exe (PID: 1476)
      • net.exe (PID: 6264)
      • cmd.exe (PID: 6356)
      • cmd.exe (PID: 2160)
      • net.exe (PID: 2072)

    • Changes the Windows auto-update feature

      • tacticalrmm.exe (PID: 6168)

    • Changes powershell execution policy (Bypass)

      • tacticalrmm.exe (PID: 7068)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6372)
      • powershell.exe (PID: 4952)
      • powershell.exe (PID: 6604)
      • powershell.exe (PID: 7024)
      • powershell.exe (PID: 1476)
      • powershell.exe (PID: 2632)
      • powershell.exe (PID: 3060)
      • powershell.exe (PID: 6332)
      • powershell.exe (PID: 5916)
      • powershell.exe (PID: 6464)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 6372)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalagent-v2.8.0-windows-amd64.exe (PID: 6916)
      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)
      • tacticalrmm.exe (PID: 6168)
      • meshagent.exe (PID: 5736)
      • tacticalrmm.exe (PID: 7068)
      • powershell.exe (PID: 6372)

    • Reads the Windows owner or organization settings

      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7008)
      • cmd.exe (PID: 6356)

    • Starts CMD.EXE for commands execution

      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)
      • cmd.exe (PID: 4536)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3812)
      • sc.exe (PID: 900)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 5780)

    • Creates or modifies Windows services

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 6324)
      • meshagent.exe (PID: 5736)
      • tacticalrmm.exe (PID: 7068)
      • tacticalrmm.exe (PID: 5556)

    • Creates a software uninstall entry

      • meshagent.exe (PID: 5736)

    • Executes as Windows Service

      • MeshAgent.exe (PID: 6572)
      • tacticalrmm.exe (PID: 7068)

    • Searches for installed software

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • There is functionality for taking screenshot (YARA)

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • MeshAgent potential remote access (YARA)

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • There is functionality for capture public ip (YARA)

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • Application launched itself

      • tacticalrmm.exe (PID: 7068)
      • cmd.exe (PID: 4536)

    • Process requests binary or script from the Internet

      • tacticalrmm.exe (PID: 6168)

    • The process bypasses the loading of PowerShell profile settings

      • tacticalrmm.exe (PID: 7068)

    • The process executes Powershell scripts

      • tacticalrmm.exe (PID: 7068)

    • The process hide an interactive prompt from the user

      • tacticalrmm.exe (PID: 7068)

    • Starts POWERSHELL.EXE for commands execution

      • tacticalrmm.exe (PID: 7068)

    • Process drops python dynamic module

      • tacticalrmm.exe (PID: 7068)

    • Process drops legitimate windows executable

      • tacticalrmm.exe (PID: 7068)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Creates a directory (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Uses WMIC.EXE to obtain data on processes

      • cmd.exe (PID: 640)
      • cmd.exe (PID: 3416)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 6372)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 6372)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 6372)

  • INFO

    • Creates files in the program directory

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)
      • tacticalrmm.exe (PID: 6324)
      • meshagent.exe (PID: 5736)
      • MeshAgent.exe (PID: 6572)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)
      • powershell.exe (PID: 6372)
      • choco.exe (PID: 4876)

    • The sample compiled with english language support

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)
      • powershell.exe (PID: 6372)
      • meshagent.exe (PID: 5736)

    • Checks supported languages

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalagent-v2.8.0-windows-amd64.exe (PID: 6916)
      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 6324)
      • meshagent.exe (PID: 5736)
      • MeshAgent.exe (PID: 6572)
      • MeshAgent.exe (PID: 1620)
      • tacticalrmm.exe (PID: 7068)
      • tacticalrmm.exe (PID: 5556)
      • MeshAgent.exe (PID: 6228)
      • choco.exe (PID: 4876)

    • Reads the machine GUID from the registry

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalrmm.exe (PID: 6324)
      • tacticalrmm.exe (PID: 6168)
      • MeshAgent.exe (PID: 6572)
      • tacticalrmm.exe (PID: 7068)
      • tacticalrmm.exe (PID: 5556)
      • choco.exe (PID: 4876)

    • Create files in a temporary directory

      • tacticalagent-v2.8.0-windows-amd64.exe (PID: 6916)
      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)

    • Reads the computer name

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 6324)
      • meshagent.exe (PID: 5736)
      • MeshAgent.exe (PID: 6572)
      • MeshAgent.exe (PID: 1620)
      • tacticalrmm.exe (PID: 7068)
      • MeshAgent.exe (PID: 6228)
      • tacticalrmm.exe (PID: 5556)
      • choco.exe (PID: 4876)

    • Reads the software policy settings

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)
      • tacticalrmm.exe (PID: 5556)

    • Application based on Golang

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • Detects GO elliptic curve encryption (YARA)

      • 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe (PID: 6672)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • Reads Environment values

      • tacticalrmm.exe (PID: 6324)
      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)
      • tacticalrmm.exe (PID: 5556)

    • Reads product name

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 6324)
      • tacticalrmm.exe (PID: 7068)
      • tacticalrmm.exe (PID: 5556)

    • Creates a software uninstall entry

      • tacticalagent-v2.8.0-windows-amd64.tmp (PID: 6944)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • tacticalrmm.exe (PID: 6168)
      • tacticalrmm.exe (PID: 7068)

    • Disables trace logs

      • powershell.exe (PID: 6372)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6372)

    • Manual execution by a user

      • cmd.exe (PID: 4536)
      • powershell.exe (PID: 6604)
      • powershell.exe (PID: 4952)
      • powershell.exe (PID: 2632)
      • powershell.exe (PID: 1476)
      • powershell.exe (PID: 7024)
      • powershell.exe (PID: 6332)
      • powershell.exe (PID: 3060)
      • powershell.exe (PID: 5916)
      • powershell.exe (PID: 6464)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6964)
      • WMIC.exe (PID: 1668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware, No debug
PEType: PE32+
LinkerVersion: 3
CodeSize: 2520576
InitializedDataSize: 246784
UninitializedDataSize: -
EntryPoint: 0x66fe0
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
FileVersionNumber: 2.0.4.0
ProductVersionNumber: 2.0.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: AmidaWare LLC
FileDescription: Tactical RMM Installer
FileVersion: v2.0.4.0
InternalName: rmm.exe
LegalCopyright: Copyright (c) 2022 AmidaWare LLC
OriginalFileName: installer.go
ProductName: Tactical RMM Installer
ProductVersion: v2.0.4.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
222
Monitored processes
102
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe conhost.exe no specs tacticalagent-v2.8.0-windows-amd64.exe tacticalagent-v2.8.0-windows-amd64.tmp cmd.exe no specs conhost.exe no specs ping.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs tacticalrmm.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs #MESHAGENT tacticalrmm.exe meshagent.exe meshagent.exe meshagent.exe no specs #MESHAGENT tacticalrmm.exe meshagent.exe no specs conhost.exe no specs tacticalrmm.exe conhost.exe no specs powershell.exe conhost.exe no specs setx.exe no specs setx.exe no specs setx.exe no specs setx.exe no specs choco.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs powershell.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs 2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244C:\WINDOWS\system32\cmd.exe /S /D /c" set /p dummy="Refreshing environment variables from registry for cmd.exe. Please wait...""C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640C:\WINDOWS\system32\cmd.exe /c wmic Process WHERE "Name='cmd.exe' AND CommandLine LIKE '%00110100000111100111110010000111101011100001000110110100011000011111110000110100101110011011001101100110000010010001101000010100%'" GET ParentProcessID /valueC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
648"C:\WINDOWS\System32\Reg" QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "OS" C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
768"C:\WINDOWS\System32\Reg" QUERY "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v "NUMBER_OF_PROCESSORS" C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
900sc delete tacticalrpcC:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1476"cmd.exe" /c net stop tacticalagentC:\Windows\SysWOW64\cmd.exe—tacticalagent-v2.8.0-windows-amd64.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1476"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\Format-FileSize.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
68 684
Read events
68 624
Write events
59
Delete events
1

Modification events

(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.2
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\TacticalAgent
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\TacticalAgent\
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:DisplayName
Value:
Tactical RMM Agent
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\TacticalAgent\tacticalrmm.exe
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\TacticalAgent\unins000.exe"
(PID) Process:(6944) tacticalagent-v2.8.0-windows-amd64.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0D34D278-5FAF-4159-A4A0-4E2D2C08139D}_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\TacticalAgent\unins000.exe" /SILENT
Executable files
142
Suspicious files
41
Text files
1 392
Unknown types
0

Dropped files

PID
Process
Filename
Type
6944tacticalagent-v2.8.0-windows-amd64.tmpC:\Program Files\TacticalAgent\is-5O1H1.tmpexecutable
MD5:5E81857286E2795352225BE245FBD62B
SHA256:2624C22DA19E89717DCD522D22B21849A1C3F0EB781333DF85BE5FCD57597278
6916tacticalagent-v2.8.0-windows-amd64.exeC:\Users\admin\AppData\Local\Temp\is-7JSPI.tmp\tacticalagent-v2.8.0-windows-amd64.tmpexecutable
MD5:A639312111D278FEE4F70299C134D620
SHA256:4B0BE5167A31A77E28E3F0A7C83C9D289845075B51E70691236603B1083649DF
6944tacticalagent-v2.8.0-windows-amd64.tmpC:\Program Files\TacticalAgent\unins000.exeexecutable
MD5:5E81857286E2795352225BE245FBD62B
SHA256:2624C22DA19E89717DCD522D22B21849A1C3F0EB781333DF85BE5FCD57597278
6944tacticalagent-v2.8.0-windows-amd64.tmpC:\Program Files\TacticalAgent\is-GO8PD.tmpexecutable
MD5:6CFBD2DA5F304A3B8972EAFE6FE4D191
SHA256:AD29D4E9E01870FFBDB6F2498E6CE36A708E56DB2AD431BA2D80BF5A6CAAC069
5736meshagent.exeC:\Program Files\Mesh Agent\MeshAgent.exeexecutable
MD5:7450D1FC59FF95B1763698ABF88CA6EF
SHA256:F5BDCB4432E1058CF9316F81FC80561C95539D7AB4254C1E46E48B29CB1D33FF
6944tacticalagent-v2.8.0-windows-amd64.tmpC:\Users\admin\AppData\Local\Temp\is-RN6QK.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
1620MeshAgent.exeC:\Program Files\Mesh Agent\MeshAgent.dbbinary
MD5:8EAA58E300399CA35A63CBCA4ADF336F
SHA256:6BDF8B727282DE5C9BD1188ECD02680B596F0C47F0C0C62EBD48312B04D7929C
6944tacticalagent-v2.8.0-windows-amd64.tmpC:\Program Files\TacticalAgent\tacticalrmm.exeexecutable
MD5:6CFBD2DA5F304A3B8972EAFE6FE4D191
SHA256:AD29D4E9E01870FFBDB6F2498E6CE36A708E56DB2AD431BA2D80BF5A6CAAC069
6944tacticalagent-v2.8.0-windows-amd64.tmpC:\Users\admin\AppData\Local\Temp\Setup Log 2025-02-18 #001.txttext
MD5:1D9CA94338C05ECE6157093851E7F179
SHA256:C316571D306E9F1CDB44287D6F7A57E2880B4A499AD67BD4B1BF6F7AE300BD2B
6572MeshAgent.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\7732266F69BB2FCB6940F13C061E7C316EE277EBbinary
MD5:75F1093AEE9B958746ADD09993D4B63C
SHA256:41E13E2567EDE5666568EF2AD318B5F85226A7850484F2BD30D6776AF3F37119
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
53
DNS requests
14
Threats
41

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.4:443
https://github.com/amidaware/rmmagent/releases/download/v2.8.0/tacticalagent-v2.8.0-windows-amd64.exe
unknown
—
—
—
—
—
GET
101
194.242.121.194:443
https://mesh.rmmlot.ru/agent.ashx
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
101
194.242.121.194:443
https://api.rmmlot.ru/natsws
unknown
—
—
—
—
—
GET
101
194.242.121.194:443
https://api.rmmlot.ru/natsws
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/amidaware/rmmagent/releases/download/v2.8.0/py3.11.9_amd64.zip
unknown
—
—
—
—
—
GET
101
194.242.121.194:443
https://mesh.rmmlot.ru/agent.ashx
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/nushell/nushell/releases/download/0.93.0/nu-0.93.0-x86_64-windows-msvc-full.zip
unknown
—
—
—
—
—
GET
302
140.82.121.4:443
https://github.com/denoland/deno/releases/download/v1.44.4/deno-x86_64-pc-windows-msvc.zip
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6672
2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted
6672
2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch.exe
185.199.109.133:443
objects.githubusercontent.com
FASTLY
US
whitelisted
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6168
tacticalrmm.exe
194.242.121.194:443
api.rmmlot.ru
Closed Joint Stock Company CROC incorporated
RU
unknown
6572
MeshAgent.exe
194.242.121.194:443
api.rmmlot.ru
Closed Joint Stock Company CROC incorporated
RU
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
github.com
  • 140.82.121.4
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
whitelisted
api.rmmlot.ru
  • 194.242.121.194
unknown
mesh.rmmlot.ru
  • 194.242.121.194
unknown
icanhazip.tacticalrmm.io
  • 188.114.97.3
  • 188.114.96.3
unknown
chocolatey.org
  • 104.18.21.76
  • 104.18.20.76
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET INFO Request for EXE via GO HTTP Client
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
—
—
Generic Protocol Command Decode
SURICATA HTTP Request unrecognized authorization method
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-02-18_3eb16bfe589fa8eede0d65e4eaa97af7_frostygoop_luca-stealer_poet-rat_snatch