Overview

overview

10

Static

static

1

be8928c5_b...is.exe

windows7_x64

10

be8928c5_b...is.exe

windows10_x64

10

Analysis

  • max time kernel
    18s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    11-05-2021 11:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    be8928c5_by_Libranalysis.exe

  • Size

    576KB

  • MD5

    be8928c5a8b81bd3dc8c5c031bffb529

  • SHA1

    f5a55492ca257306cb51b10169cf37bb6bee4caf

  • SHA256

    b9b7c8c13a609e6a8ecdafaf039b5f7505f7fb72d444a41ff7705a8a249e4b4b

  • SHA512

    c8b5c29602ea94d5b605bc57a7934f91b6be3711dfd865c06409abc88aaded09922cea5f7c7e940651e8b0d5918a8b76e6c249ab57da3d243a67f0cc377892f4

Score
10/10
snakekeyloggerkeyloggerpersistencespywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    smtp.ionos.com
  • Port:
    587
  • Username:
    office@airtechair.net
  • Password:
    Airtech2010@

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be8928c5_by_Libranalysis.exe
    "C:\Users\Admin\AppData\Local\Temp\be8928c5_by_Libranalysis.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Users\Admin\AppData\Local\Temp\be8928c5_by_Libranalysis.exe
      "C:\Users\Admin\AppData\Local\Temp\be8928c5_by_Libranalysis.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd9780.tmp\soiovgmvyq6.dll
    MD5

    045d1c71d5d4ed65dae388d75d1c9578

    SHA1

    d305920290dcf113b5bf16ebd93ecc41f2857a55

    SHA256

    2b7927f1ecf4ca76c066ef892edcae560a9682cb2dd2ef388e07a62f81746931

    SHA512

    efd0f432e89ee7eee94386c79d828ef6b4c47f40ce00b1d189e4c8dca04b62695fdbfa0b0e0499fcaf97d6e30fa4cb8098986962803ee308f2ccf465dc0812d8

    Download Submit
  • memory/980-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/980-64-0x0000000000560000-0x0000000000563000-memory.dmp
    Filesize

    12KB

    Download
  • memory/2008-62-0x000000000040188B-mapping.dmp
    Download
  • memory/2008-65-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

    Download
  • memory/2008-66-0x0000000001DA0000-0x0000000001E03000-memory.dmp
    Filesize

    396KB

    Download
  • memory/2008-68-0x00000000020A1000-0x00000000020A2000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-69-0x00000000020A2000-0x00000000020A3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-70-0x00000000020A3000-0x00000000020A4000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-71-0x00000000020A4000-0x00000000020A5000-memory.dmp
    Filesize

    4KB

    Download