Analysis
- max time kernel
127s - max time network
128s - platform
windows10_x64 - resource
win10v20201028 - submitted
27/01/2021, 21:43
General
- Target SecuriteInfo.com.Trojan.Packed2.42783.3265.4746.exe
- Size 1.6MB
- Sample210127-mtb79gzkne
- SHA256 93db921e5b0cfe2de4485e03e756c4123c90046fe2fb83a36e60f4ccee822e28
Malware Config
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.42783.3265.4746.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Packed2.42783.3265.4746.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "mnye" /t REG_SZ /d "C:\Users\Admin\oine.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "mnye" /t REG_SZ /d "C:\Users\Admin\oine.exe"3⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\oine.exe"C:\Users\Admin\oine.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-28-0x0000000008E50000-0x0000000008E51000-memory.dmp
memory/576-27-0x0000000008E40000-0x0000000008E4B000-memory.dmp
memory/576-26-0x00000000053B1000-0x00000000053B2000-memory.dmp
memory/576-21-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/576-17-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/1388-33-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/1388-41-0x0000000005B30000-0x0000000005B31000-memory.dmp
memory/1388-39-0x0000000005B80000-0x0000000005B81000-memory.dmp
memory/1388-38-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/1388-36-0x0000000005050000-0x0000000005051000-memory.dmp
memory/1388-34-0x0000000000600000-0x0000000000668000-memory.dmp
memory/4636-9-0x00000000082D0000-0x00000000082D1000-memory.dmp
memory/4636-3-0x0000000000890000-0x0000000000891000-memory.dmp
memory/4636-5-0x0000000005230000-0x0000000005231000-memory.dmp
memory/4636-2-0x0000000073D60000-0x000000007444E000-memory.dmp
memory/4636-7-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/4636-8-0x0000000005DD0000-0x0000000005DEE000-memory.dmp
memory/4636-13-0x00000000054D1000-0x00000000054D2000-memory.dmp
memory/4636-10-0x0000000008700000-0x0000000008701000-memory.dmp