Overview

overview

10

Static

static

SecuriteIn...28.exe

windows7_x64

10

SecuriteIn...28.exe

windows10_x64

10

Analysis

  • max time kernel
    105s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    20-04-2021 13:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe

  • Size

    235KB

  • MD5

    f800c3f06fc079a0b96c979a887c4000

  • SHA1

    ba0327ab0611bac6334c1b2fbda5a148dff52a6c

  • SHA256

    376fb5dbb339a77640a9ebc77162ab11c63186c48fa6f7c0a1717caacb9b70b6

  • SHA512

    335b71986422533f7d294aec3bd5c6ef48528f596f534a45ba31814ba913c4d8a4d3e6e9d26c390357668d2b2e6fde3f40c89a990b1de8e297c6cfa1bbe04523

Score
10/10
snakekeyloggerkeyloggerpersistencespywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    janryone.xyz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    *sQwqe$]n1[z

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
      C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
      2⤵
        PID:3376
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
        C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
        2⤵
          PID:1936
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
          C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.GenericKD.36741716.4036.9128.exe.log
        MD5

        808e884c00533a9eb0e13e64960d9c3a

        SHA1

        279d05181fc6179a12df1a669ff5d8b64c1380ae

        SHA256

        2f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6

        SHA512

        9489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299

        Download Submit
      • memory/2216-126-0x0000000006980000-0x0000000006981000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2216-119-0x0000000000400000-0x000000000046A000-memory.dmp
        Filesize

        424KB

        Download
      • memory/2216-120-0x000000000046476E-mapping.dmp
        Download
      • memory/2216-124-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2216-125-0x0000000005880000-0x0000000005881000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2216-127-0x00000000057D0000-0x0000000005CCE000-memory.dmp
        Filesize

        5.0MB

        Download
      • memory/2216-128-0x0000000006CC0000-0x0000000006CC1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2216-129-0x0000000006B90000-0x0000000006B91000-memory.dmp
        Filesize

        4KB

        Download
      • memory/2216-130-0x0000000006970000-0x0000000006971000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3176-117-0x0000000004E50000-0x0000000004E51000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3176-118-0x00000000059A0000-0x00000000059DC000-memory.dmp
        Filesize

        240KB

        Download
      • memory/3176-116-0x0000000004E40000-0x0000000004E42000-memory.dmp
        Filesize

        8KB

        Download
      • memory/3176-114-0x0000000000660000-0x0000000000661000-memory.dmp
        Filesize

        4KB

        Download