Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-04-2021 08:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.generic.ml.28900.2294.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
SecuriteInfo.com.generic.ml.28900.2294.exe
Resource
win10v20210408
General
-
Target
SecuriteInfo.com.generic.ml.28900.2294.exe
-
Size
242KB
-
MD5
d4d8ef44275700e1b44a4c82fa18a7e7
-
SHA1
8773c3226a0b274aaeb281ff9bcb1acbb37817b4
-
SHA256
a77a3638d5c7d0c986f01af3db3f8e92b0acb6c8311c9c20bcca49658c09c975
-
SHA512
d4b3ed932fcdd32519fdeb2db2e9affcaecbeb035e0d7b2fcc65355f5d87eed950b8ea69d094d2f578d3775cf7cd863187ac1ddaeadb3dc661ccdc0c45ecbe76
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
nobetone.xyz - Port:
587 - Username:
[email protected] - Password:
@QP5Et$cNKpj
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\.notepad.exe\"," SecuriteInfo.com.generic.ml.28900.2294.exe -
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/672-65-0x000000000046476E-mapping.dmp family_snakekeylogger behavioral1/memory/672-64-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral1/memory/672-66-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 checkip.dyndns.org 16 freegeoip.app 17 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exedescription pid process target process PID 1040 set thread context of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exeSecuriteInfo.com.generic.ml.28900.2294.exepid process 1040 SecuriteInfo.com.generic.ml.28900.2294.exe 1040 SecuriteInfo.com.generic.ml.28900.2294.exe 672 SecuriteInfo.com.generic.ml.28900.2294.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exeSecuriteInfo.com.generic.ml.28900.2294.exedescription pid process Token: SeDebugPrivilege 1040 SecuriteInfo.com.generic.ml.28900.2294.exe Token: SeDebugPrivilege 672 SecuriteInfo.com.generic.ml.28900.2294.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exedescription pid process target process PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1040 wrote to memory of 672 1040 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-65-0x000000000046476E-mapping.dmp
-
memory/672-64-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/672-66-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/672-68-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/1040-59-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/1040-61-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/1040-62-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/1040-63-0x0000000000C30000-0x0000000000C70000-memory.dmpFilesize
256KB