Analysis
-
max time kernel
105s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 16:20
Static task
static1
Behavioral task
behavioral1
Sample
000900000000900.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
000900000000900.exe
Resource
win10v20201028
General
-
Target
000900000000900.exe
-
Size
958KB
-
MD5
9986f70e963e69f4e25ec67cc0a0b66a
-
SHA1
0f3c4623479f32e809212b08d32b944ffc522857
-
SHA256
438fdfe2373cc3461f9294fab147d74beae972ad80620002d60ccd6f27f8c966
-
SHA512
a23c62e62bd7fafd8b40611847c893cba459e3db794678d3fdc7b5208b789b32b30fac332b8cfef03a9bff76c83391bece184a11b46aed80b3b80aab389c295f
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4184-22-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral2/memory/4184-23-0x00000000004643BE-mapping.dmp family_snakekeylogger -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 checkip.dyndns.org 17 freegeoip.app 18 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
000900000000900.exedescription pid process target process PID 4648 set thread context of 4184 4648 000900000000900.exe InstallUtil.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3524 4648 WerFault.exe 000900000000900.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Powershell.exe000900000000900.exeInstallUtil.exeWerFault.exepid process 3432 Powershell.exe 3432 Powershell.exe 4648 000900000000900.exe 4648 000900000000900.exe 4648 000900000000900.exe 4648 000900000000900.exe 4184 InstallUtil.exe 3432 Powershell.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe 3524 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Powershell.exe000900000000900.exeInstallUtil.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3432 Powershell.exe Token: SeDebugPrivilege 4648 000900000000900.exe Token: SeDebugPrivilege 4184 InstallUtil.exe Token: SeRestorePrivilege 3524 WerFault.exe Token: SeBackupPrivilege 3524 WerFault.exe Token: SeDebugPrivilege 3524 WerFault.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
000900000000900.exedescription pid process target process PID 4648 wrote to memory of 3432 4648 000900000000900.exe Powershell.exe PID 4648 wrote to memory of 3432 4648 000900000000900.exe Powershell.exe PID 4648 wrote to memory of 3432 4648 000900000000900.exe Powershell.exe PID 4648 wrote to memory of 3340 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 3340 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 3340 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4180 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4180 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4180 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe PID 4648 wrote to memory of 4184 4648 000900000000900.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\000900000000900.exe"C:\Users\Admin\AppData\Local\Temp\000900000000900.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\000900000000900.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 11922⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3432-20-0x0000000007282000-0x0000000007283000-memory.dmpFilesize
4KB
-
memory/3432-39-0x0000000009470000-0x0000000009471000-memory.dmpFilesize
4KB
-
memory/3432-17-0x00000000077F0000-0x00000000077F1000-memory.dmpFilesize
4KB
-
memory/3432-40-0x0000000009500000-0x0000000009501000-memory.dmpFilesize
4KB
-
memory/3432-19-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/3432-38-0x00000000095A0000-0x00000000095A1000-memory.dmpFilesize
4KB
-
memory/3432-32-0x0000000008780000-0x0000000008781000-memory.dmpFilesize
4KB
-
memory/3432-26-0x00000000088E0000-0x00000000088E1000-memory.dmpFilesize
4KB
-
memory/3432-11-0x0000000000000000-mapping.dmp
-
memory/3432-12-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/3432-13-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/3432-14-0x00000000078C0000-0x00000000078C1000-memory.dmpFilesize
4KB
-
memory/3432-15-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/3432-16-0x0000000007780000-0x0000000007781000-memory.dmpFilesize
4KB
-
memory/3432-42-0x0000000007283000-0x0000000007284000-memory.dmpFilesize
4KB
-
memory/3432-24-0x0000000007FB0000-0x0000000007FB1000-memory.dmpFilesize
4KB
-
memory/3524-34-0x00000000041D0000-0x00000000041D1000-memory.dmpFilesize
4KB
-
memory/4184-33-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/4184-35-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/4184-22-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/4184-25-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/4184-23-0x00000000004643BE-mapping.dmp
-
memory/4648-3-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/4648-21-0x0000000005140000-0x000000000514F000-memory.dmpFilesize
60KB
-
memory/4648-10-0x0000000002C20000-0x0000000002C21000-memory.dmpFilesize
4KB
-
memory/4648-9-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/4648-2-0x0000000073E30000-0x000000007451E000-memory.dmpFilesize
6.9MB
-
memory/4648-27-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/4648-8-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/4648-7-0x0000000005230000-0x00000000052C1000-memory.dmpFilesize
580KB
-
memory/4648-6-0x0000000005190000-0x0000000005191000-memory.dmpFilesize
4KB
-
memory/4648-5-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB