Overview

overview

10

Static

static

ACH Paymen...ed.exe

windows7_x64

10

ACH Paymen...ed.exe

windows10_x64

10

Analysis

  • max time kernel
    116s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    23-04-2021 10:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ACH Payment Initiated & Received.exe

  • Size

    536KB

  • MD5

    16db1dad94d7c7bff556c87395af1a94

  • SHA1

    077d1ab9d2870562be9dfa431ce6651aa6179207

  • SHA256

    2346a1bdc66b319e0cb751f7c8aea0c5164917d30a349b2a1a8d0566fbd60671

  • SHA512

    2f24816b4c25281deda76b070dbe9d705e9aaa6518983f5f944ae698c222f0c9f9d3981ac3a70859d4333e54aae28afc219b3c5b9354cc50f42d145bc9faa5d7

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.lokalboyz.com
  • Port:
    587
  • Username:
    oc2021@lokalboyz.com
  • Password:
    lkEb6ovn

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe
    "C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe
      "C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe"
      2⤵
        PID:968
      • C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe
        "C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe"
        2⤵
          PID:1700
        • C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe
          "C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe"
          2⤵
            PID:560
          • C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe
            "C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe"
            2⤵
              PID:1704
            • C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe
              "C:\Users\Admin\AppData\Local\Temp\ACH Payment Initiated & Received.exe"
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1108

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          Credential Access

          Credentials in Files

          2
          T1081

          Discovery

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1108-65-0x0000000000400000-0x000000000046A000-memory.dmp
            Filesize

            424KB

            Download
          • memory/1108-66-0x00000000004643FE-mapping.dmp
            Download
          • memory/1108-67-0x0000000000400000-0x000000000046A000-memory.dmp
            Filesize

            424KB

            Download
          • memory/1108-69-0x0000000004940000-0x0000000004941000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1944-59-0x00000000001E0000-0x00000000001E1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1944-61-0x00000000002C0000-0x00000000002C9000-memory.dmp
            Filesize

            36KB

            Download
          • memory/1944-62-0x00000000044B0000-0x00000000044B1000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1944-63-0x0000000004F40000-0x0000000004FAA000-memory.dmp
            Filesize

            424KB

            Download
          • memory/1944-64-0x0000000007440000-0x00000000074AF000-memory.dmp
            Filesize

            444KB

            Download