Analysis
-
max time kernel
17s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 16:20
Static task
static1
Behavioral task
behavioral1
Sample
000900000000900.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
000900000000900.exe
Resource
win10v20201028
General
-
Target
000900000000900.exe
-
Size
958KB
-
MD5
9986f70e963e69f4e25ec67cc0a0b66a
-
SHA1
0f3c4623479f32e809212b08d32b944ffc522857
-
SHA256
438fdfe2373cc3461f9294fab147d74beae972ad80620002d60ccd6f27f8c966
-
SHA512
a23c62e62bd7fafd8b40611847c893cba459e3db794678d3fdc7b5208b789b32b30fac332b8cfef03a9bff76c83391bece184a11b46aed80b3b80aab389c295f
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/576-15-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral1/memory/576-16-0x00000000004643BE-mapping.dmp family_snakekeylogger behavioral1/memory/576-19-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 freegeoip.app 3 checkip.dyndns.org 10 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
000900000000900.exedescription pid process target process PID 1656 set thread context of 576 1656 000900000000900.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1268 1656 WerFault.exe 000900000000900.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Powershell.exeInstallUtil.exeWerFault.exepid process 1236 Powershell.exe 576 InstallUtil.exe 1236 Powershell.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe 1268 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Powershell.exeInstallUtil.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1236 Powershell.exe Token: SeDebugPrivilege 576 InstallUtil.exe Token: SeDebugPrivilege 1268 WerFault.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
000900000000900.exedescription pid process target process PID 1656 wrote to memory of 1236 1656 000900000000900.exe Powershell.exe PID 1656 wrote to memory of 1236 1656 000900000000900.exe Powershell.exe PID 1656 wrote to memory of 1236 1656 000900000000900.exe Powershell.exe PID 1656 wrote to memory of 1236 1656 000900000000900.exe Powershell.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 576 1656 000900000000900.exe InstallUtil.exe PID 1656 wrote to memory of 1268 1656 000900000000900.exe WerFault.exe PID 1656 wrote to memory of 1268 1656 000900000000900.exe WerFault.exe PID 1656 wrote to memory of 1268 1656 000900000000900.exe WerFault.exe PID 1656 wrote to memory of 1268 1656 000900000000900.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\000900000000900.exe"C:\Users\Admin\AppData\Local\Temp\000900000000900.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\000900000000900.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 6722⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-15-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/576-21-0x0000000004250000-0x0000000004251000-memory.dmpFilesize
4KB
-
memory/576-19-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/576-17-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/576-16-0x00000000004643BE-mapping.dmp
-
memory/1236-9-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/1236-31-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1236-10-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/1236-11-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/1236-39-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/1236-13-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/1236-14-0x00000000048F2000-0x00000000048F3000-memory.dmpFilesize
4KB
-
memory/1236-32-0x00000000061B0000-0x00000000061B1000-memory.dmpFilesize
4KB
-
memory/1236-7-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/1236-6-0x0000000000000000-mapping.dmp
-
memory/1236-18-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/1236-30-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/1236-25-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/1236-22-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/1268-40-0x0000000000000000-mapping.dmp
-
memory/1268-41-0x0000000001F50000-0x0000000001F61000-memory.dmpFilesize
68KB
-
memory/1268-42-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/1656-3-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB
-
memory/1656-5-0x0000000000AF0000-0x0000000000B81000-memory.dmpFilesize
580KB
-
memory/1656-2-0x0000000074640000-0x0000000074D2E000-memory.dmpFilesize
6.9MB
-
memory/1656-8-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/1656-12-0x00000000002E0000-0x00000000002EF000-memory.dmpFilesize
60KB