Presupuesto urgente PST56654256778982, pdf.exe

General
Target

Presupuesto urgente PST56654256778982, pdf.exe

Filesize

852KB

Completed

04-05-2021 15:28

Score
10 /10
MD5

d6b608c55871cf8d00f5daacd3d8c858

SHA1

3a53fd8d9d5e5b136aea4083f6881a18c59414ef

SHA256

acb59cfe4c0dcdfdbc835fce99582cae54d6d3afb2233eab94a0a22bfd2c2dd7

Malware Config

Extracted

Family snakekeylogger
Credentials

Protocol: smtp

Host: smtp.endovision.xyz

Port: 587

Username: info@endovision.xyz

Password: r)($czxJs0

Signatures 9

Filter: none

Collection
Credential Access
  • Snake Keylogger

    Description

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/360-125-0x0000000000400000-0x000000000046A000-memory.dmpfamily_snakekeylogger
    behavioral2/memory/360-126-0x00000000004643FE-mapping.dmpfamily_snakekeylogger
    behavioral2/memory/360-132-0x0000000005910000-0x0000000005E0E000-memory.dmpfamily_snakekeylogger
  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    20freegeoip.app
    16checkip.dyndns.org
    19freegeoip.app
  • Suspicious use of SetThreadContext
    Presupuesto urgente PST56654256778982, pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3876 set thread context of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
  • Suspicious behavior: EnumeratesProcesses
    Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe

    Reported IOCs

    pidprocess
    3876Presupuesto urgente PST56654256778982, pdf.exe
    3876Presupuesto urgente PST56654256778982, pdf.exe
    360Presupuesto urgente PST56654256778982, pdf.exe
  • Suspicious use of AdjustPrivilegeToken
    Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3876Presupuesto urgente PST56654256778982, pdf.exe
    Token: SeDebugPrivilege360Presupuesto urgente PST56654256778982, pdf.exe
  • Suspicious use of WriteProcessMemory
    Presupuesto urgente PST56654256778982, pdf.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3876 wrote to memory of 40563876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 40563876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 40563876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
    PID 3876 wrote to memory of 3603876Presupuesto urgente PST56654256778982, pdf.exePresupuesto urgente PST56654256778982, pdf.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\Presupuesto urgente PST56654256778982, pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Presupuesto urgente PST56654256778982, pdf.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3876
    • C:\Users\Admin\AppData\Local\Temp\Presupuesto urgente PST56654256778982, pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Presupuesto urgente PST56654256778982, pdf.exe"
      PID:4056
    • C:\Users\Admin\AppData\Local\Temp\Presupuesto urgente PST56654256778982, pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Presupuesto urgente PST56654256778982, pdf.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:360
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Presupuesto urgente PST56654256778982, pdf.exe.log

                        MD5

                        90acfd72f14a512712b1a7380c0faf60

                        SHA1

                        40ba4accb8faa75887e84fb8e38d598dc8cf0f12

                        SHA256

                        20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

                        SHA512

                        29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

                      • memory/360-133-0x0000000006B70000-0x0000000006B71000-memory.dmp

                      • memory/360-132-0x0000000005910000-0x0000000005E0E000-memory.dmp

                      • memory/360-126-0x00000000004643FE-mapping.dmp

                      • memory/360-125-0x0000000000400000-0x000000000046A000-memory.dmp

                      • memory/3876-122-0x0000000004D00000-0x0000000004D01000-memory.dmp

                      • memory/3876-121-0x0000000005210000-0x000000000521E000-memory.dmp

                      • memory/3876-120-0x0000000004F30000-0x0000000004F31000-memory.dmp

                      • memory/3876-123-0x0000000005AF0000-0x0000000005B90000-memory.dmp

                      • memory/3876-124-0x0000000008040000-0x00000000080DD000-memory.dmp

                      • memory/3876-119-0x0000000004E90000-0x0000000004E91000-memory.dmp

                      • memory/3876-118-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                      • memory/3876-117-0x00000000052F0000-0x00000000052F1000-memory.dmp

                      • memory/3876-116-0x0000000004D50000-0x0000000004D51000-memory.dmp

                      • memory/3876-114-0x0000000000390000-0x0000000000391000-memory.dmp