Analysis

  • max time kernel
    62s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-01-2021 07:24

General

  • Target

    RFQ (2).exe

  • Size

    1.2MB

  • MD5

    d83147c1f2843a7debadb1c3c3c19d9d

  • SHA1

    edb9c5c09ae378cf30611dc1b5e01ab10aea2615

  • SHA256

    ff8d39974554acf40538107995f0f6b000be41747ca6c34dae415df33596d5a3

  • SHA512

    ebf6c57062b60ae23f6d5504b2f02d6dc9688ca71dd23c4a219dfca27d42913a855a8b9022422fda67355ef031e747133a9da9013bafea32cfe43bd78d1ceca3

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger Payload 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ (2).exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ (2).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Users\Admin\AppData\Local\Temp\RFQ (2).exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ (2).exe"
      2⤵
        PID:3396
      • C:\Users\Admin\AppData\Local\Temp\RFQ (2).exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ (2).exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3176

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ (2).exe.log
      MD5

      dd89b34edc792ceab180bb56b030767a

      SHA1

      c3693b19777f357fe57fec64ba3d5097a0d865b9

      SHA256

      83db7c977f8c7b7e87da95ae284c5ff0b98aee77b39034446b61db779ecb277e

      SHA512

      c8186fc9607e8c89acad798e627a3072d67cd8db909585b46a76cc5e0e56cf9159943407b39795596b09c51e0524bcda4c1a96cfa0ca000460a2beb93c25c9fa

    • memory/3176-15-0x0000000000400000-0x0000000000466000-memory.dmp
      Filesize

      408KB

    • memory/3176-24-0x0000000006940000-0x0000000006941000-memory.dmp
      Filesize

      4KB

    • memory/3176-23-0x0000000005680000-0x0000000005681000-memory.dmp
      Filesize

      4KB

    • memory/3176-18-0x0000000073900000-0x0000000073FEE000-memory.dmp
      Filesize

      6.9MB

    • memory/3176-16-0x0000000000461EEE-mapping.dmp
    • memory/4684-7-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
      Filesize

      4KB

    • memory/4684-10-0x0000000004D50000-0x0000000004D51000-memory.dmp
      Filesize

      4KB

    • memory/4684-11-0x0000000004F90000-0x0000000004F91000-memory.dmp
      Filesize

      4KB

    • memory/4684-12-0x0000000004F80000-0x0000000004F81000-memory.dmp
      Filesize

      4KB

    • memory/4684-13-0x0000000004F20000-0x0000000004F43000-memory.dmp
      Filesize

      140KB

    • memory/4684-14-0x0000000005F60000-0x0000000005FF9000-memory.dmp
      Filesize

      612KB

    • memory/4684-9-0x00000000057C0000-0x00000000057C1000-memory.dmp
      Filesize

      4KB

    • memory/4684-8-0x00000000027C0000-0x00000000027C1000-memory.dmp
      Filesize

      4KB

    • memory/4684-2-0x0000000073900000-0x0000000073FEE000-memory.dmp
      Filesize

      6.9MB

    • memory/4684-6-0x00000000052C0000-0x00000000052C1000-memory.dmp
      Filesize

      4KB

    • memory/4684-5-0x0000000004C30000-0x0000000004C31000-memory.dmp
      Filesize

      4KB

    • memory/4684-3-0x0000000000310000-0x0000000000311000-memory.dmp
      Filesize

      4KB