Overview

overview

10

Static

static

SHIPMENT.EXE

windows7_x64

10

SHIPMENT.EXE

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-02-2021 09:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SHIPMENT.EXE

  • Size

    16KB

  • MD5

    063765a246e5de199afcac8a77a1138e

  • SHA1

    6ee29c38d9942f0026845e8c26d77f1ec051d0cc

  • SHA256

    0f57eaac051c7f259290f747b71e93068fdc6dcd5ce2a4d513c096e4f60a71b4

  • SHA512

    75c07c20c513d725b315cc24f772c375ba2c41951e0370f19d66a3323e72039b4beae1319109b557fae54987635892ba1d57b90be0db278f77dcdc12ffc73ec9

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SHIPMENT.EXE
    "C:\Users\Admin\AppData\Local\Temp\SHIPMENT.EXE"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:3024
    • C:\Users\Admin\AppData\Local\Temp\SHIPMENT.EXE
      "C:\Users\Admin\AppData\Local\Temp\SHIPMENT.EXE"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1872
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/800-15-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

    Download
  • memory/800-26-0x0000000006D00000-0x0000000006D01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/800-23-0x0000000005610000-0x0000000005611000-memory.dmp
    Filesize

    4KB

    Download
  • memory/800-17-0x0000000073290000-0x000000007397E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/800-16-0x0000000000464B6E-mapping.dmp
    Download
  • memory/1112-9-0x0000000006940000-0x0000000006A17000-memory.dmp
    Filesize

    860KB

    Download
  • memory/1112-11-0x0000000006A20000-0x0000000006A21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1112-12-0x00000000049E0000-0x00000000049E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1112-10-0x0000000006F20000-0x0000000006F21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1112-2-0x0000000073290000-0x000000007397E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1112-6-0x00000000056A0000-0x00000000056A1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1112-5-0x0000000004F90000-0x0000000004F91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1112-3-0x0000000000650000-0x0000000000651000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3024-14-0x0000000000000000-mapping.dmp
    Download
  • memory/3668-13-0x0000000000000000-mapping.dmp
    Download
  • memory/3988-22-0x0000000004530000-0x0000000004531000-memory.dmp
    Filesize

    4KB

    Download