Analysis
-
max time kernel
64s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-04-2021 08:47
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.generic.ml.28900.2294.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
SecuriteInfo.com.generic.ml.28900.2294.exe
Resource
win10v20210408
General
-
Target
SecuriteInfo.com.generic.ml.28900.2294.exe
-
Size
242KB
-
MD5
d4d8ef44275700e1b44a4c82fa18a7e7
-
SHA1
8773c3226a0b274aaeb281ff9bcb1acbb37817b4
-
SHA256
a77a3638d5c7d0c986f01af3db3f8e92b0acb6c8311c9c20bcca49658c09c975
-
SHA512
d4b3ed932fcdd32519fdeb2db2e9affcaecbeb035e0d7b2fcc65355f5d87eed950b8ea69d094d2f578d3775cf7cd863187ac1ddaeadb3dc661ccdc0c45ecbe76
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
nobetone.xyz - Port:
587 - Username:
[email protected] - Password:
@QP5Et$cNKpj
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\.notepad.exe\"," SecuriteInfo.com.generic.ml.28900.2294.exe -
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1492-119-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral2/memory/1492-120-0x000000000046476E-mapping.dmp family_snakekeylogger -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 checkip.dyndns.org 23 freegeoip.app 24 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exedescription pid process target process PID 1000 set thread context of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exeSecuriteInfo.com.generic.ml.28900.2294.exepid process 1000 SecuriteInfo.com.generic.ml.28900.2294.exe 1000 SecuriteInfo.com.generic.ml.28900.2294.exe 1492 SecuriteInfo.com.generic.ml.28900.2294.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exeSecuriteInfo.com.generic.ml.28900.2294.exedescription pid process Token: SeDebugPrivilege 1000 SecuriteInfo.com.generic.ml.28900.2294.exe Token: SeDebugPrivilege 1492 SecuriteInfo.com.generic.ml.28900.2294.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
SecuriteInfo.com.generic.ml.28900.2294.exedescription pid process target process PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe PID 1000 wrote to memory of 1492 1000 SecuriteInfo.com.generic.ml.28900.2294.exe SecuriteInfo.com.generic.ml.28900.2294.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.28900.2294.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.generic.ml.28900.2294.exe.logMD5
808e884c00533a9eb0e13e64960d9c3a
SHA1279d05181fc6179a12df1a669ff5d8b64c1380ae
SHA2562f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6
SHA5129489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299
-
memory/1000-118-0x00000000060D0000-0x0000000006110000-memory.dmpFilesize
256KB
-
memory/1000-117-0x0000000001730000-0x0000000001731000-memory.dmpFilesize
4KB
-
memory/1000-114-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/1000-116-0x0000000001710000-0x0000000001712000-memory.dmpFilesize
8KB
-
memory/1492-119-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1492-120-0x000000000046476E-mapping.dmp
-
memory/1492-124-0x0000000005D30000-0x0000000005D31000-memory.dmpFilesize
4KB
-
memory/1492-125-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/1492-126-0x00000000068E0000-0x00000000068E1000-memory.dmpFilesize
4KB
-
memory/1492-127-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/1492-128-0x0000000006C20000-0x0000000006C21000-memory.dmpFilesize
4KB
-
memory/1492-129-0x0000000006AF0000-0x0000000006AF1000-memory.dmpFilesize
4KB
-
memory/1492-130-0x0000000006A70000-0x0000000006A71000-memory.dmpFilesize
4KB