Overview

overview

10

Static

static

Shipment document.exe

windows7_x64

10

Shipment document.exe

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-02-2021 06:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shipment document.exe

  • Size

    16KB

  • MD5

    063765a246e5de199afcac8a77a1138e

  • SHA1

    6ee29c38d9942f0026845e8c26d77f1ec051d0cc

  • SHA256

    0f57eaac051c7f259290f747b71e93068fdc6dcd5ce2a4d513c096e4f60a71b4

  • SHA512

    75c07c20c513d725b315cc24f772c375ba2c41951e0370f19d66a3323e72039b4beae1319109b557fae54987635892ba1d57b90be0db278f77dcdc12ffc73ec9

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shipment document.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipment document.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1428
    • C:\Users\Admin\AppData\Local\Temp\Shipment document.exe
      "C:\Users\Admin\AppData\Local\Temp\Shipment document.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 1880
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/744-13-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

    Download
  • memory/744-26-0x0000000006DA0000-0x0000000006DA1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/744-23-0x00000000054A0000-0x00000000054A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/744-15-0x0000000073450000-0x0000000073B3E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/744-14-0x0000000000464B6E-mapping.dmp
    Download
  • memory/1204-7-0x0000000007E10000-0x0000000007EE7000-memory.dmp
    Filesize

    860KB

    Download
  • memory/1204-9-0x0000000007F90000-0x0000000007F91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1204-10-0x0000000005A70000-0x0000000005A71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1204-8-0x00000000083F0000-0x00000000083F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1204-2-0x0000000073450000-0x0000000073B3E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1204-6-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1204-5-0x00000000051A0000-0x00000000051A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1204-3-0x0000000000910000-0x0000000000911000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1428-12-0x0000000000000000-mapping.dmp
    Download
  • memory/3776-20-0x0000000004640000-0x0000000004641000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3776-21-0x0000000004640000-0x0000000004641000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3932-11-0x0000000000000000-mapping.dmp
    Download