Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
29-01-2021 16:34
Static task
static1
Behavioral task
behavioral1
Sample
IMG_058741601.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
IMG_058741601.exe
Resource
win10v20201028
General
-
Target
IMG_058741601.exe
-
Size
732KB
-
MD5
59380235fed3c5300b01b07ca70148ca
-
SHA1
81e1f14e30fa437a464d1e068e1963a14212c623
-
SHA256
9bb2525c48049ffd05b8ad6a39a89245b6a4de4914275fcfad2beee8bfaa714d
-
SHA512
4bce9d19a8388a3915861b3daa125be6611f8532187a9266bc08425e2dbd5f600c429ed252ea1486daf43f64e665241404378353c06e42d100659ee28807b451
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1696-29-0x0000000000400000-0x0000000000468000-memory.dmp family_snakekeylogger behavioral2/memory/1696-30-0x0000000000463A9E-mapping.dmp family_snakekeylogger -
Executes dropped EXE 2 IoCs
Processes:
mnoi.exeInstallUtil.exepid process 4092 mnoi.exe 1696 InstallUtil.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\etsb = "C:\\Users\\Admin\\mnoi.exe" reg.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 checkip.dyndns.org 21 freegeoip.app 22 freegeoip.app -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
mnoi.exedescription pid process target process PID 4092 set thread context of 1696 4092 mnoi.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
IMG_058741601.exemnoi.exeInstallUtil.exepid process 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 3888 IMG_058741601.exe 4092 mnoi.exe 4092 mnoi.exe 1696 InstallUtil.exe 1696 InstallUtil.exe 1696 InstallUtil.exe 1696 InstallUtil.exe 1696 InstallUtil.exe 1696 InstallUtil.exe 1696 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
IMG_058741601.exemnoi.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3888 IMG_058741601.exe Token: SeDebugPrivilege 4092 mnoi.exe Token: SeDebugPrivilege 1696 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
IMG_058741601.execmd.exemnoi.exedescription pid process target process PID 3888 wrote to memory of 2392 3888 IMG_058741601.exe cmd.exe PID 3888 wrote to memory of 2392 3888 IMG_058741601.exe cmd.exe PID 3888 wrote to memory of 2392 3888 IMG_058741601.exe cmd.exe PID 2392 wrote to memory of 188 2392 cmd.exe reg.exe PID 2392 wrote to memory of 188 2392 cmd.exe reg.exe PID 2392 wrote to memory of 188 2392 cmd.exe reg.exe PID 3888 wrote to memory of 4092 3888 IMG_058741601.exe mnoi.exe PID 3888 wrote to memory of 4092 3888 IMG_058741601.exe mnoi.exe PID 3888 wrote to memory of 4092 3888 IMG_058741601.exe mnoi.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe PID 4092 wrote to memory of 1696 4092 mnoi.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_058741601.exe"C:\Users\Admin\AppData\Local\Temp\IMG_058741601.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "etsb" /t REG_SZ /d "C:\Users\Admin\mnoi.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "etsb" /t REG_SZ /d "C:\Users\Admin\mnoi.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\mnoi.exe"C:\Users\Admin\mnoi.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\mnoi.exeMD5
59380235fed3c5300b01b07ca70148ca
SHA181e1f14e30fa437a464d1e068e1963a14212c623
SHA2569bb2525c48049ffd05b8ad6a39a89245b6a4de4914275fcfad2beee8bfaa714d
SHA5124bce9d19a8388a3915861b3daa125be6611f8532187a9266bc08425e2dbd5f600c429ed252ea1486daf43f64e665241404378353c06e42d100659ee28807b451
-
C:\Users\Admin\mnoi.exeMD5
59380235fed3c5300b01b07ca70148ca
SHA181e1f14e30fa437a464d1e068e1963a14212c623
SHA2569bb2525c48049ffd05b8ad6a39a89245b6a4de4914275fcfad2beee8bfaa714d
SHA5124bce9d19a8388a3915861b3daa125be6611f8532187a9266bc08425e2dbd5f600c429ed252ea1486daf43f64e665241404378353c06e42d100659ee28807b451
-
memory/188-12-0x0000000000000000-mapping.dmp
-
memory/1696-38-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1696-33-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/1696-36-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/1696-30-0x0000000000463A9E-mapping.dmp
-
memory/1696-39-0x00000000065C0000-0x00000000065C1000-memory.dmpFilesize
4KB
-
memory/1696-41-0x0000000006850000-0x0000000006851000-memory.dmpFilesize
4KB
-
memory/1696-29-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2392-11-0x0000000000000000-mapping.dmp
-
memory/3888-10-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3888-8-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/3888-3-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/3888-5-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/3888-7-0x00000000027D0000-0x00000000027EE000-memory.dmpFilesize
120KB
-
memory/3888-9-0x0000000008150000-0x0000000008151000-memory.dmpFilesize
4KB
-
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3888-13-0x0000000004F31000-0x0000000004F32000-memory.dmpFilesize
4KB
-
memory/4092-14-0x0000000000000000-mapping.dmp
-
memory/4092-17-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/4092-21-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/4092-28-0x000000000C370000-0x000000000C371000-memory.dmpFilesize
4KB
-
memory/4092-27-0x0000000008980000-0x000000000898B000-memory.dmpFilesize
44KB
-
memory/4092-26-0x0000000005171000-0x0000000005172000-memory.dmpFilesize
4KB