Overview

overview

10

Static

static

Shipment document.exe

windows7_x64

10

Shipment document.exe

windows10_x64

10

Analysis

  • max time kernel
    114s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-02-2021 09:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shipment document.exe

  • Size

    16KB

  • MD5

    063765a246e5de199afcac8a77a1138e

  • SHA1

    6ee29c38d9942f0026845e8c26d77f1ec051d0cc

  • SHA256

    0f57eaac051c7f259290f747b71e93068fdc6dcd5ce2a4d513c096e4f60a71b4

  • SHA512

    75c07c20c513d725b315cc24f772c375ba2c41951e0370f19d66a3323e72039b4beae1319109b557fae54987635892ba1d57b90be0db278f77dcdc12ffc73ec9

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shipment document.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipment document.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:416
    • C:\Users\Admin\AppData\Local\Temp\Shipment document.exe
      "C:\Users\Admin\AppData\Local\Temp\Shipment document.exe"
      2⤵
        PID:1380
      • C:\Users\Admin\AppData\Local\Temp\Shipment document.exe
        "C:\Users\Admin\AppData\Local\Temp\Shipment document.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1880
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3808

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/416-12-0x0000000000000000-mapping.dmp
      Download
    • memory/652-3-0x0000000000040000-0x0000000000041000-memory.dmp
      Filesize

      4KB

      Download
    • memory/652-5-0x0000000004840000-0x0000000004841000-memory.dmp
      Filesize

      4KB

      Download
    • memory/652-6-0x0000000002110000-0x0000000002111000-memory.dmp
      Filesize

      4KB

      Download
    • memory/652-7-0x0000000005180000-0x0000000005257000-memory.dmp
      Filesize

      860KB

      Download
    • memory/652-8-0x00000000067D0000-0x00000000067D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/652-9-0x0000000006380000-0x0000000006381000-memory.dmp
      Filesize

      4KB

      Download
    • memory/652-10-0x0000000006310000-0x0000000006311000-memory.dmp
      Filesize

      4KB

      Download
    • memory/652-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1000-15-0x0000000073FF0000-0x00000000746DE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1000-13-0x0000000000400000-0x000000000046A000-memory.dmp
      Filesize

      424KB

      Download
    • memory/1000-14-0x0000000000464B6E-mapping.dmp
      Download
    • memory/1000-23-0x0000000006AA0000-0x0000000006AA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1000-24-0x0000000005350000-0x0000000005351000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2608-11-0x0000000000000000-mapping.dmp
      Download
    • memory/3808-20-0x0000000004600000-0x0000000004601000-memory.dmp
      Filesize

      4KB

      Download