Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/02/2021, 18:41
General
- Target Document.exe
- Size 892KB
- Sample210210-n2v9deklba
- SHA256 c126c825de9ddbbf35ebcd0f63205c80f769e55d95d27e1dadda8b5c9d245569
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.ru
-
Port
587
-
Username
-
Password
p34gTdA9zQgpr87mb8
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.exe"C:\Users\Admin\AppData\Local\Temp\Document.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Document.exe"C:\Users\Admin\AppData\Local\Temp\Document.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3252-12-0x0000000002502000-0x0000000002503000-memory.dmp
memory/3252-11-0x0000000002500000-0x0000000002501000-memory.dmp
memory/3252-6-0x0000000000400000-0x000000000047A000-memory.dmp
memory/3252-7-0x00000000048B0000-0x0000000004914000-memory.dmp
memory/3252-9-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/3252-10-0x0000000005000000-0x0000000005001000-memory.dmp
memory/3252-5-0x0000000073A80000-0x000000007416E000-memory.dmp
memory/3252-13-0x0000000002503000-0x0000000002504000-memory.dmp
memory/3252-14-0x0000000002504000-0x0000000002505000-memory.dmp
memory/3252-15-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/3252-16-0x0000000005930000-0x0000000005931000-memory.dmp
memory/3252-17-0x0000000005C80000-0x0000000005C81000-memory.dmp
memory/3252-18-0x0000000002507000-0x0000000002509000-memory.dmp