Analysis
-
max time kernel
18s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:58
Static task
static1
Behavioral task
behavioral1
Sample
0009099889000.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0009099889000.exe
Resource
win10v20201028
General
-
Target
0009099889000.exe
-
Size
669KB
-
MD5
edab703ee29783721ea20698a5b612a0
-
SHA1
64bb591072817159806aea7c850a2f63527138ea
-
SHA256
9acf2d500081ec8152e15e994cd78b6bc7ac0b5bc812cd92e091a9b49d619cbb
-
SHA512
0b31f7945823a3efb641db5f087849ef0e1113fd5a4e67b1b080d1b201cc863de8d0ec3471bf1dfe01da00256b3ebbf5fee9f299cdddb9c1df1b732344c9baf1
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-13-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral1/memory/1456-14-0x00000000004643BE-mapping.dmp family_snakekeylogger behavioral1/memory/1456-18-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 checkip.dyndns.org 10 freegeoip.app 11 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0009099889000.exedescription pid process target process PID 324 set thread context of 1456 324 0009099889000.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1600 324 WerFault.exe 0009099889000.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Powershell.exeInstallUtil.exeWerFault.exepid process 1776 Powershell.exe 1456 InstallUtil.exe 1776 Powershell.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe 1600 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Powershell.exeInstallUtil.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1776 Powershell.exe Token: SeDebugPrivilege 1456 InstallUtil.exe Token: SeDebugPrivilege 1600 WerFault.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
0009099889000.exedescription pid process target process PID 324 wrote to memory of 1776 324 0009099889000.exe Powershell.exe PID 324 wrote to memory of 1776 324 0009099889000.exe Powershell.exe PID 324 wrote to memory of 1776 324 0009099889000.exe Powershell.exe PID 324 wrote to memory of 1776 324 0009099889000.exe Powershell.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1456 324 0009099889000.exe InstallUtil.exe PID 324 wrote to memory of 1600 324 0009099889000.exe WerFault.exe PID 324 wrote to memory of 1600 324 0009099889000.exe WerFault.exe PID 324 wrote to memory of 1600 324 0009099889000.exe WerFault.exe PID 324 wrote to memory of 1600 324 0009099889000.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0009099889000.exe"C:\Users\Admin\AppData\Local\Temp\0009099889000.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\0009099889000.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 6642⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/324-2-0x0000000074DA0000-0x000000007548E000-memory.dmpFilesize
6.9MB
-
memory/324-3-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/324-5-0x0000000004B50000-0x0000000004BE1000-memory.dmpFilesize
580KB
-
memory/324-6-0x0000000001FC0000-0x0000000001FC1000-memory.dmpFilesize
4KB
-
memory/324-12-0x0000000000370000-0x000000000037F000-memory.dmpFilesize
60KB
-
memory/1456-18-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1456-21-0x0000000001330000-0x0000000001331000-memory.dmpFilesize
4KB
-
memory/1456-13-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1456-14-0x00000000004643BE-mapping.dmp
-
memory/1456-15-0x0000000074DA0000-0x000000007548E000-memory.dmpFilesize
6.9MB
-
memory/1600-42-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1600-41-0x00000000021A0000-0x00000000021B1000-memory.dmpFilesize
68KB
-
memory/1600-40-0x0000000000000000-mapping.dmp
-
memory/1776-9-0x0000000074DA0000-0x000000007548E000-memory.dmpFilesize
6.9MB
-
memory/1776-30-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1776-16-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/1776-20-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/1776-11-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1776-22-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/1776-25-0x0000000006030000-0x0000000006031000-memory.dmpFilesize
4KB
-
memory/1776-17-0x0000000004912000-0x0000000004913000-memory.dmpFilesize
4KB
-
memory/1776-31-0x0000000006080000-0x0000000006081000-memory.dmpFilesize
4KB
-
memory/1776-32-0x0000000006170000-0x0000000006171000-memory.dmpFilesize
4KB
-
memory/1776-39-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1776-10-0x0000000002190000-0x0000000002191000-memory.dmpFilesize
4KB
-
memory/1776-8-0x00000000766C1000-0x00000000766C3000-memory.dmpFilesize
8KB
-
memory/1776-7-0x0000000000000000-mapping.dmp