Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 12:14
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Details.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Consignment Details.exe
Resource
win10v20210408
General
-
Target
Consignment Details.exe
-
Size
3.0MB
-
MD5
13d99c2ac641f89128925263d6ddc4f4
-
SHA1
3e68058db2a6da752fd3e711955bed24440d6471
-
SHA256
55519e954b4b28f0d1497294eab96130c3932928fdf4a739c9a94a884379282f
-
SHA512
8aef281d74bdb0da823c4c91855563e82bf6bbbaaeb88a528d06992b59feeae64f1f6fbf4dc49e2d5e6de8dcfd9cabc2654b6a3acc5f7c30628c4d8d9f8285c5
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
gmicaprelam.in - Port:
587 - Username:
shege@gmicaprelam.in - Password:
shege2424@
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/200-122-0x0000000000400000-0x0000000000468000-memory.dmp family_snakekeylogger behavioral2/memory/200-123-0x000000000046202E-mapping.dmp family_snakekeylogger behavioral2/memory/200-128-0x0000000005560000-0x0000000005A5E000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 freegeoip.app 23 freegeoip.app 19 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Consignment Details.exedescription pid process target process PID 604 set thread context of 200 604 Consignment Details.exe Consignment Details.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Consignment Details.exeConsignment Details.exepid process 604 Consignment Details.exe 604 Consignment Details.exe 200 Consignment Details.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Consignment Details.exeConsignment Details.exedescription pid process Token: SeDebugPrivilege 604 Consignment Details.exe Token: SeDebugPrivilege 200 Consignment Details.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Consignment Details.exedescription pid process target process PID 604 wrote to memory of 208 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 208 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 208 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe PID 604 wrote to memory of 200 604 Consignment Details.exe Consignment Details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/200-122-0x0000000000400000-0x0000000000468000-memory.dmpFilesize
416KB
-
memory/200-131-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/200-130-0x0000000006A40000-0x0000000006A41000-memory.dmpFilesize
4KB
-
memory/200-129-0x0000000006870000-0x0000000006871000-memory.dmpFilesize
4KB
-
memory/200-128-0x0000000005560000-0x0000000005A5E000-memory.dmpFilesize
5.0MB
-
memory/200-123-0x000000000046202E-mapping.dmp
-
memory/604-118-0x0000000002C00000-0x0000000002C01000-memory.dmpFilesize
4KB
-
memory/604-121-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/604-120-0x00000000053A0000-0x000000000540B000-memory.dmpFilesize
428KB
-
memory/604-119-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/604-114-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/604-117-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/604-116-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB