Analysis

  • max time kernel
    151s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 07:16

General

  • Target

    IMG_13791.doc

  • Size

    623KB

  • MD5

    f07ba9823647515d52c35fdc53936c2e

  • SHA1

    2072b8921e48ffc0cfe1560e989cf63957b4343a

  • SHA256

    26a2b448dc82400ef64b88557b9443731bf994f0539ccb147b14a9a89c0283d1

  • SHA512

    87d3007aace763d6181b5c098fac1f28e58f6dfa74fb8375c08f190c129b2abb46068dabb115834e0287cbf8600fd08a05e4a9be47ba9248edf66456e4b5478f

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger Payload 2 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\IMG_13791.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1952
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1732
      • C:\Users\Public\69577.exe
        "C:\Users\Public\69577.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "not" /t REG_SZ /d "C:\Users\Admin\scis.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "not" /t REG_SZ /d "C:\Users\Admin\scis.exe"
            4⤵
            • Adds Run key to start application
            PID:1820
        • C:\Users\Admin\scis.exe
          "C:\Users\Admin\scis.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
            "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1380

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

      MD5

      91c9ae9c9a17a9db5e08b120e668c74c

      SHA1

      50770954c1ceb0bb6f1d5d3f2de2a0a065773723

      SHA256

      e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

      SHA512

      ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

    • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe

      MD5

      91c9ae9c9a17a9db5e08b120e668c74c

      SHA1

      50770954c1ceb0bb6f1d5d3f2de2a0a065773723

      SHA256

      e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

      SHA512

      ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V84I7BUN.txt

      MD5

      826f9a380c5041676822fc65de52466e

      SHA1

      9f87407fced2b39124d049519d44587c2c4f869c

      SHA256

      995f5115bdddb8879510dad9fc20d70f31d66535638957617ffb26675b5c1dda

      SHA512

      1da239475c794ee7c24747cee20249c2e7b7264bd253554248b0202771fb3b5349302965b9c34843bf814d4f40fe0327989f38a87430bc410e1bb655ae44827a

    • C:\Users\Admin\scis.exe

      MD5

      52254e42523afbd28c7377c6b7f82cc0

      SHA1

      bc9fdf2d59e3b3c54c4dc1cdea9c5954ceebc32e

      SHA256

      db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

      SHA512

      0a88462bdefb64e98e93737580a0a0ad212c2e3e0fe6ed9448b67271ece6edf379bc3404d4f622016fe3b0779c39dc4600340a2693d78313421efcf47db5398c

    • C:\Users\Admin\scis.exe

      MD5

      52254e42523afbd28c7377c6b7f82cc0

      SHA1

      bc9fdf2d59e3b3c54c4dc1cdea9c5954ceebc32e

      SHA256

      db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

      SHA512

      0a88462bdefb64e98e93737580a0a0ad212c2e3e0fe6ed9448b67271ece6edf379bc3404d4f622016fe3b0779c39dc4600340a2693d78313421efcf47db5398c

    • C:\Users\Public\69577.exe

      MD5

      52254e42523afbd28c7377c6b7f82cc0

      SHA1

      bc9fdf2d59e3b3c54c4dc1cdea9c5954ceebc32e

      SHA256

      db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

      SHA512

      0a88462bdefb64e98e93737580a0a0ad212c2e3e0fe6ed9448b67271ece6edf379bc3404d4f622016fe3b0779c39dc4600340a2693d78313421efcf47db5398c

    • C:\Users\Public\69577.exe

      MD5

      52254e42523afbd28c7377c6b7f82cc0

      SHA1

      bc9fdf2d59e3b3c54c4dc1cdea9c5954ceebc32e

      SHA256

      db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

      SHA512

      0a88462bdefb64e98e93737580a0a0ad212c2e3e0fe6ed9448b67271ece6edf379bc3404d4f622016fe3b0779c39dc4600340a2693d78313421efcf47db5398c

    • \Users\Admin\AppData\Local\Temp\InstallUtil.exe

      MD5

      91c9ae9c9a17a9db5e08b120e668c74c

      SHA1

      50770954c1ceb0bb6f1d5d3f2de2a0a065773723

      SHA256

      e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

      SHA512

      ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

    • \Users\Admin\scis.exe

      MD5

      52254e42523afbd28c7377c6b7f82cc0

      SHA1

      bc9fdf2d59e3b3c54c4dc1cdea9c5954ceebc32e

      SHA256

      db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

      SHA512

      0a88462bdefb64e98e93737580a0a0ad212c2e3e0fe6ed9448b67271ece6edf379bc3404d4f622016fe3b0779c39dc4600340a2693d78313421efcf47db5398c

    • \Users\Public\69577.exe

      MD5

      52254e42523afbd28c7377c6b7f82cc0

      SHA1

      bc9fdf2d59e3b3c54c4dc1cdea9c5954ceebc32e

      SHA256

      db0b892ea1b776ac1324cdb701d9d5fe49e4817259e93cedf8249ed3f9983664

      SHA512

      0a88462bdefb64e98e93737580a0a0ad212c2e3e0fe6ed9448b67271ece6edf379bc3404d4f622016fe3b0779c39dc4600340a2693d78313421efcf47db5398c

    • memory/328-8-0x000007FEF5E90000-0x000007FEF610A000-memory.dmp

      Filesize

      2.5MB

    • memory/1104-33-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB

    • memory/1104-36-0x0000000004B31000-0x0000000004B32000-memory.dmp

      Filesize

      4KB

    • memory/1104-32-0x0000000000580000-0x000000000058B000-memory.dmp

      Filesize

      44KB

    • memory/1104-31-0x0000000004B30000-0x0000000004B31000-memory.dmp

      Filesize

      4KB

    • memory/1104-27-0x00000000011C0000-0x00000000011C1000-memory.dmp

      Filesize

      4KB

    • memory/1104-26-0x000000006ADF0000-0x000000006B4DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1104-23-0x0000000000000000-mapping.dmp

    • memory/1380-40-0x0000000000090000-0x00000000000F8000-memory.dmp

      Filesize

      416KB

    • memory/1380-38-0x000000000046251E-mapping.dmp

    • memory/1380-41-0x000000006ADF0000-0x000000006B4DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1380-42-0x0000000000090000-0x0000000000092000-memory.dmp

      Filesize

      8KB

    • memory/1380-45-0x0000000000620000-0x0000000000621000-memory.dmp

      Filesize

      4KB

    • memory/1452-18-0x0000000004A80000-0x0000000004A81000-memory.dmp

      Filesize

      4KB

    • memory/1452-21-0x0000000004A81000-0x0000000004A82000-memory.dmp

      Filesize

      4KB

    • memory/1452-17-0x0000000000350000-0x0000000000351000-memory.dmp

      Filesize

      4KB

    • memory/1452-16-0x00000000002F0000-0x000000000030E000-memory.dmp

      Filesize

      120KB

    • memory/1452-10-0x0000000000000000-mapping.dmp

    • memory/1452-14-0x00000000010E0000-0x00000000010E1000-memory.dmp

      Filesize

      4KB

    • memory/1452-13-0x000000006ADF0000-0x000000006B4DE000-memory.dmp

      Filesize

      6.9MB

    • memory/1732-7-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

      Filesize

      8KB

    • memory/1820-20-0x0000000000000000-mapping.dmp

    • memory/1840-19-0x0000000000000000-mapping.dmp

    • memory/1952-5-0x0000000000000000-mapping.dmp

    • memory/1952-6-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

      Filesize

      8KB

    • memory/1964-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1964-3-0x000000006FDB1000-0x000000006FDB3000-memory.dmp

      Filesize

      8KB

    • memory/1964-2-0x0000000072331000-0x0000000072334000-memory.dmp

      Filesize

      12KB