Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-01-2021 11:45
Static task
static1
Behavioral task
behavioral1
Sample
Pick-Up Schedule.com.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Pick-Up Schedule.com.exe
Resource
win10v20201028
General
-
Target
Pick-Up Schedule.com.exe
-
Size
751KB
-
MD5
d0d5e54bec67f0d0d382865d3cc7c688
-
SHA1
b6eeb227349d15fd64ec30fc3888c2cc90b8fc13
-
SHA256
207942189e81358c6fb92ad355747146ffa7465ba8563b178bdc6f57ae4e0afb
-
SHA512
bb015d52d51de322ea07a34f772c79cb8af3b3a7cf0db8ad5214e7e983e3041ddc89a683b791dded835688191087e59775353fa067416a4a9b75484bf9d56c4c
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2244-21-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral2/memory/2244-22-0x000000000046463E-mapping.dmp family_snakekeylogger -
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe Powershell.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 checkip.dyndns.org 14 freegeoip.app 15 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Pick-Up Schedule.com.exedescription pid process target process PID 640 set thread context of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2348 640 WerFault.exe Pick-Up Schedule.com.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Powershell.exeRegAsm.exeWerFault.exepid process 3412 Powershell.exe 2244 RegAsm.exe 3412 Powershell.exe 3412 Powershell.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe 2348 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Powershell.exeRegAsm.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3412 Powershell.exe Token: SeDebugPrivilege 2244 RegAsm.exe Token: SeRestorePrivilege 2348 WerFault.exe Token: SeBackupPrivilege 2348 WerFault.exe Token: SeDebugPrivilege 2348 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Pick-Up Schedule.com.exedescription pid process target process PID 640 wrote to memory of 3412 640 Pick-Up Schedule.com.exe Powershell.exe PID 640 wrote to memory of 3412 640 Pick-Up Schedule.com.exe Powershell.exe PID 640 wrote to memory of 3412 640 Pick-Up Schedule.com.exe Powershell.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe PID 640 wrote to memory of 2244 640 Pick-Up Schedule.com.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pick-Up Schedule.com.exe"C:\Users\Admin\AppData\Local\Temp\Pick-Up Schedule.com.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Pick-Up Schedule.com.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I$s#$lT3ssl.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 18842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-18-0x0000000009850000-0x000000000985F000-memory.dmpFilesize
60KB
-
memory/640-3-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/640-5-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/640-6-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/640-7-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/640-8-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/640-9-0x0000000009780000-0x00000000097F6000-memory.dmpFilesize
472KB
-
memory/640-10-0x0000000009910000-0x0000000009911000-memory.dmpFilesize
4KB
-
memory/640-11-0x0000000009A20000-0x0000000009A21000-memory.dmpFilesize
4KB
-
memory/640-12-0x0000000009D70000-0x0000000009D71000-memory.dmpFilesize
4KB
-
memory/640-47-0x0000000005265000-0x0000000005266000-memory.dmpFilesize
4KB
-
memory/640-14-0x0000000005263000-0x0000000005265000-memory.dmpFilesize
8KB
-
memory/640-40-0x0000000009FC0000-0x0000000009FC1000-memory.dmpFilesize
4KB
-
memory/640-38-0x0000000009FF0000-0x0000000009FF1000-memory.dmpFilesize
4KB
-
memory/640-2-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2244-21-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2244-26-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/2244-36-0x0000000006750000-0x0000000006751000-memory.dmpFilesize
4KB
-
memory/2244-22-0x000000000046463E-mapping.dmp
-
memory/2244-32-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/2348-48-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/3412-34-0x0000000007330000-0x0000000007331000-memory.dmpFilesize
4KB
-
memory/3412-17-0x0000000006C60000-0x0000000006C61000-memory.dmpFilesize
4KB
-
memory/3412-24-0x0000000007290000-0x0000000007291000-memory.dmpFilesize
4KB
-
memory/3412-23-0x0000000006B80000-0x0000000006B81000-memory.dmpFilesize
4KB
-
memory/3412-33-0x0000000006790000-0x0000000006791000-memory.dmpFilesize
4KB
-
memory/3412-20-0x0000000006622000-0x0000000006623000-memory.dmpFilesize
4KB
-
memory/3412-35-0x0000000007CD0000-0x0000000007CD1000-memory.dmpFilesize
4KB
-
memory/3412-25-0x00000000074E0000-0x00000000074E1000-memory.dmpFilesize
4KB
-
memory/3412-16-0x0000000004120000-0x0000000004121000-memory.dmpFilesize
4KB
-
memory/3412-15-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/3412-42-0x0000000008A60000-0x0000000008A61000-memory.dmpFilesize
4KB
-
memory/3412-43-0x0000000008900000-0x0000000008901000-memory.dmpFilesize
4KB
-
memory/3412-44-0x0000000008960000-0x0000000008961000-memory.dmpFilesize
4KB
-
memory/3412-46-0x0000000006623000-0x0000000006624000-memory.dmpFilesize
4KB
-
memory/3412-13-0x0000000000000000-mapping.dmp
-
memory/3412-19-0x0000000006620000-0x0000000006621000-memory.dmpFilesize
4KB