Analysis

  • max time kernel
    68s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    19-01-2021 06:39

General

  • Target

    Zz92XfcijKVXcny.exe

  • Size

    1.4MB

  • MD5

    bfcd8470a0944381db7660977261f9db

  • SHA1

    44c413af5e0479fabb0486151cc6d2bdff33de6a

  • SHA256

    ed8596ea2c9c957127281b2a4380c20f6ef825a4f6f0814094975c66bc5ebec1

  • SHA512

    e336045d1a8247385d073205fdce676cdac5593af2b6003c8a7b828bf2e2a3eda61da439574721d55cd63b942982278af3c05e78f0d1cd7df388f9134497d45d

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger Payload 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zz92XfcijKVXcny.exe
    "C:\Users\Admin\AppData\Local\Temp\Zz92XfcijKVXcny.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xHfHWx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF670.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:380
    • C:\Users\Admin\AppData\Local\Temp\Zz92XfcijKVXcny.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1484

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF670.tmp
    MD5

    7ecfa0120c846940a43f45d41888f0b2

    SHA1

    07bbf035edf86bbc0f7c764909e09891dac16fac

    SHA256

    f80fae230f11f47987ff4ccc618c10867e6d177491fbe2f0cfc63dcd76d8c669

    SHA512

    1939fb035d78268b52784ccb4d7c813009dea6e89f1f681287821e1f5baf30ead7281a0b829b32c603d2e519351e55b4af60e1fc61e74578d7005f872dc227be

  • memory/380-9-0x0000000000000000-mapping.dmp
  • memory/1056-6-0x0000000005E40000-0x0000000005E41000-memory.dmp
    Filesize

    4KB

  • memory/1056-2-0x0000000073C60000-0x000000007434E000-memory.dmp
    Filesize

    6.9MB

  • memory/1056-7-0x0000000000500000-0x000000000050E000-memory.dmp
    Filesize

    56KB

  • memory/1056-8-0x000000000BFA0000-0x000000000C033000-memory.dmp
    Filesize

    588KB

  • memory/1056-5-0x00000000003D0000-0x0000000000451000-memory.dmp
    Filesize

    516KB

  • memory/1056-3-0x0000000001030000-0x0000000001031000-memory.dmp
    Filesize

    4KB

  • memory/1484-12-0x000000000046573E-mapping.dmp
  • memory/1484-11-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1484-13-0x0000000073C60000-0x000000007434E000-memory.dmp
    Filesize

    6.9MB

  • memory/1484-14-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1484-16-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
    Filesize

    4KB