Analysis
-
max time kernel
109s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-02-2021 08:21
Static task
static1
Behavioral task
behavioral1
Sample
NEW PURCHASE ORDER.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
NEW PURCHASE ORDER.exe
Resource
win10v20201028
General
-
Target
NEW PURCHASE ORDER.exe
-
Size
577KB
-
MD5
3080525809aefe707920c99cf4188b9a
-
SHA1
ca74f0622d9125aa89c563609ad562f82f1877c7
-
SHA256
5c490fcd927f87434dca860aa71947a31942bcabfed0adb27ab16a0fe1412fe1
-
SHA512
7abaf9d7002dbf437c991629d6cd876b69a0ee05f1fef586c3b8749cbededddc486524082c6065ad1260c0aa3c5976c2edeb9f8901dda19a1557bf0040c06eb5
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2736-14-0x0000000000400000-0x0000000000468000-memory.dmp family_snakekeylogger behavioral2/memory/2736-15-0x0000000000463E5E-mapping.dmp family_snakekeylogger -
Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
Processes:
resource yara_rule behavioral2/memory/508-7-0x00000000057D0000-0x000000000585E000-memory.dmp beds_protector -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 checkip.dyndns.org 15 freegeoip.app 16 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW PURCHASE ORDER.exedescription pid process target process PID 508 set thread context of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
NEW PURCHASE ORDER.exeRegAsm.exepid process 508 NEW PURCHASE ORDER.exe 508 NEW PURCHASE ORDER.exe 508 NEW PURCHASE ORDER.exe 508 NEW PURCHASE ORDER.exe 2736 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
NEW PURCHASE ORDER.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 508 NEW PURCHASE ORDER.exe Token: SeDebugPrivilege 2736 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
NEW PURCHASE ORDER.exedescription pid process target process PID 508 wrote to memory of 2692 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2692 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2692 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2740 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2740 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2740 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe PID 508 wrote to memory of 2736 508 NEW PURCHASE ORDER.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/508-11-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/508-7-0x00000000057D0000-0x000000000585E000-memory.dmpFilesize
568KB
-
memory/508-2-0x0000000073D50000-0x000000007443E000-memory.dmpFilesize
6.9MB
-
memory/508-6-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/508-12-0x0000000009200000-0x0000000009201000-memory.dmpFilesize
4KB
-
memory/508-8-0x0000000006130000-0x0000000006131000-memory.dmpFilesize
4KB
-
memory/508-9-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/508-13-0x0000000005BB0000-0x0000000005BBF000-memory.dmpFilesize
60KB
-
memory/508-5-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/508-3-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/508-10-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/508-16-0x0000000005923000-0x0000000005925000-memory.dmpFilesize
8KB
-
memory/2736-15-0x0000000000463E5E-mapping.dmp
-
memory/2736-14-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/2736-17-0x0000000073D50000-0x000000007443E000-memory.dmpFilesize
6.9MB
-
memory/2736-22-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/2736-23-0x0000000006730000-0x0000000006731000-memory.dmpFilesize
4KB