Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 13:50
Static task
static1
Behavioral task
behavioral1
Sample
C103-202005514-05,PDF.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
C103-202005514-05,PDF.exe
Resource
win10v20201028
General
-
Target
C103-202005514-05,PDF.exe
-
Size
584KB
-
MD5
eedd3f21579280588e987a0431315356
-
SHA1
e4232454d3c2e86fedba56dbb0f83363dbfe96bf
-
SHA256
cdc918638a38eb856105db8b22281142b5cc58f6538ad4e848e45d552332b5fd
-
SHA512
f1934302099a9d9e45e9aeba3f7fea64fb15021888580bfbe2e21e3a7183e2e01919f2f36163a328480e6d89607baf8ac8ba7180f0975cb103c1e37850d79c64
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3008-18-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral2/memory/3008-19-0x000000000046463E-mapping.dmp family_snakekeylogger -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 checkip.dyndns.org 14 freegeoip.app 15 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
C103-202005514-05,PDF.exedescription pid process target process PID 652 set thread context of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2204 652 WerFault.exe C103-202005514-05,PDF.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
C103-202005514-05,PDF.exePowershell.exeRegAsm.exeWerFault.exepid process 652 C103-202005514-05,PDF.exe 652 C103-202005514-05,PDF.exe 652 C103-202005514-05,PDF.exe 652 C103-202005514-05,PDF.exe 3848 Powershell.exe 3008 RegAsm.exe 3848 Powershell.exe 3848 Powershell.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe 2204 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Powershell.exeC103-202005514-05,PDF.exeRegAsm.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3848 Powershell.exe Token: SeDebugPrivilege 652 C103-202005514-05,PDF.exe Token: SeDebugPrivilege 3008 RegAsm.exe Token: SeRestorePrivilege 2204 WerFault.exe Token: SeBackupPrivilege 2204 WerFault.exe Token: SeDebugPrivilege 2204 WerFault.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
C103-202005514-05,PDF.exedescription pid process target process PID 652 wrote to memory of 3848 652 C103-202005514-05,PDF.exe Powershell.exe PID 652 wrote to memory of 3848 652 C103-202005514-05,PDF.exe Powershell.exe PID 652 wrote to memory of 3848 652 C103-202005514-05,PDF.exe Powershell.exe PID 652 wrote to memory of 200 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 200 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 200 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 204 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 204 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 204 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe PID 652 wrote to memory of 3008 652 C103-202005514-05,PDF.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\C103-202005514-05,PDF.exe"C:\Users\Admin\AppData\Local\Temp\C103-202005514-05,PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\C103-202005514-05,PDF.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 16602⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/652-9-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/652-3-0x0000000000530000-0x0000000000531000-memory.dmpFilesize
4KB
-
memory/652-5-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/652-6-0x0000000004DC0000-0x0000000004E36000-memory.dmpFilesize
472KB
-
memory/652-7-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/652-8-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/652-17-0x0000000004EA0000-0x0000000004EAF000-memory.dmpFilesize
60KB
-
memory/652-10-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/652-38-0x0000000005D20000-0x0000000005D21000-memory.dmpFilesize
4KB
-
memory/652-37-0x0000000005D60000-0x0000000005D61000-memory.dmpFilesize
4KB
-
memory/652-32-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/652-2-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/2204-45-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/3008-19-0x000000000046463E-mapping.dmp
-
memory/3008-31-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/3008-18-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/3008-39-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB
-
memory/3008-34-0x00000000064E0000-0x00000000064E1000-memory.dmpFilesize
4KB
-
memory/3008-21-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/3848-22-0x0000000008150000-0x0000000008151000-memory.dmpFilesize
4KB
-
memory/3848-20-0x0000000007A80000-0x0000000007A81000-memory.dmpFilesize
4KB
-
memory/3848-29-0x0000000008820000-0x0000000008821000-memory.dmpFilesize
4KB
-
memory/3848-30-0x0000000008BB0000-0x0000000008BB1000-memory.dmpFilesize
4KB
-
memory/3848-15-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/3848-14-0x0000000007AB0000-0x0000000007AB1000-memory.dmpFilesize
4KB
-
memory/3848-33-0x0000000008C00000-0x0000000008C01000-memory.dmpFilesize
4KB
-
memory/3848-23-0x00000000082C0000-0x00000000082C1000-memory.dmpFilesize
4KB
-
memory/3848-13-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/3848-12-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/3848-16-0x0000000005012000-0x0000000005013000-memory.dmpFilesize
4KB
-
memory/3848-40-0x0000000009900000-0x0000000009901000-memory.dmpFilesize
4KB
-
memory/3848-41-0x00000000097F0000-0x00000000097F1000-memory.dmpFilesize
4KB
-
memory/3848-42-0x0000000009880000-0x0000000009881000-memory.dmpFilesize
4KB
-
memory/3848-44-0x0000000005013000-0x0000000005014000-memory.dmpFilesize
4KB
-
memory/3848-11-0x0000000000000000-mapping.dmp