Analysis
-
max time kernel
23s -
max time network
119s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 13:02
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order E3007921.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Purchase Order E3007921.exe
Resource
win10v20210408
General
-
Target
Purchase Order E3007921.exe
-
Size
31KB
-
MD5
dac3ac141a3e0abb27839284a1df864c
-
SHA1
8802717f07d933b2478b0cae6f410cce79b9f0a9
-
SHA256
9af68d42d1d36c20d81306679715a6f7e3d427d8c039344653f4ec6b43cd7ac5
-
SHA512
3d984a6a4d689d950d8a3e55b2ec6901f4525ae8e7cce41be7ee0267cd9808da20c30ff9de43715b57b613a946215bf37aea999e5ac79e2ab1d7b63fc9d994f0
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1791466927:AAHD_mKnN05jD74hk8VEfBe-NORCSbM6oaM/sendMessage?chat_id=1413771094
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-64-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral1/memory/1648-65-0x000000000046447E-mapping.dmp family_snakekeylogger behavioral1/memory/1648-66-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger -
Downloads MZ/PE file
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 checkip.dyndns.org 14 freegeoip.app 15 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order E3007921.exedescription pid process target process PID 1840 set thread context of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Purchase Order E3007921.exepid process 1648 Purchase Order E3007921.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order E3007921.exePurchase Order E3007921.exedescription pid process Token: SeDebugPrivilege 1840 Purchase Order E3007921.exe Token: SeDebugPrivilege 1648 Purchase Order E3007921.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order E3007921.exedescription pid process target process PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 1840 wrote to memory of 1648 1840 Purchase Order E3007921.exe Purchase Order E3007921.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1648-64-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1648-65-0x000000000046447E-mapping.dmp
-
memory/1648-66-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1648-68-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1840-60-0x0000000001290000-0x0000000001291000-memory.dmpFilesize
4KB
-
memory/1840-62-0x0000000001240000-0x0000000001241000-memory.dmpFilesize
4KB
-
memory/1840-63-0x0000000000450000-0x0000000000472000-memory.dmpFilesize
136KB