Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-05-2021 13:02
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order E3007921.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Purchase Order E3007921.exe
Resource
win10v20210408
General
-
Target
Purchase Order E3007921.exe
-
Size
31KB
-
MD5
dac3ac141a3e0abb27839284a1df864c
-
SHA1
8802717f07d933b2478b0cae6f410cce79b9f0a9
-
SHA256
9af68d42d1d36c20d81306679715a6f7e3d427d8c039344653f4ec6b43cd7ac5
-
SHA512
3d984a6a4d689d950d8a3e55b2ec6901f4525ae8e7cce41be7ee0267cd9808da20c30ff9de43715b57b613a946215bf37aea999e5ac79e2ab1d7b63fc9d994f0
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1791466927:AAHD_mKnN05jD74hk8VEfBe-NORCSbM6oaM/sendMessage?chat_id=1413771094
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3280-120-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral2/memory/3280-121-0x000000000046447E-mapping.dmp family_snakekeylogger behavioral2/memory/3280-127-0x00000000055D0000-0x0000000005ACE000-memory.dmp family_snakekeylogger -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 checkip.dyndns.org 19 freegeoip.app 20 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order E3007921.exedescription pid process target process PID 860 set thread context of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Purchase Order E3007921.exepid process 3280 Purchase Order E3007921.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order E3007921.exePurchase Order E3007921.exedescription pid process Token: SeDebugPrivilege 860 Purchase Order E3007921.exe Token: SeDebugPrivilege 3280 Purchase Order E3007921.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Purchase Order E3007921.exedescription pid process target process PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe PID 860 wrote to memory of 3280 860 Purchase Order E3007921.exe Purchase Order E3007921.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order E3007921.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order E3007921.exe.logMD5
bca5d9d288a7809c63f2d594cb7c7b94
SHA111689c8a592cd8706f0155b4574488dd872cbd97
SHA256d7a3ed9b26c989e840532a7f0fa21bc508f8fbcb2d37116fade84280f2a865ed
SHA512db30f307e6818573f06f115818476104abfce94f15d9ad11e8163aa3cc19cee4cc3c87c98ef45d5c978b6f166089cc0283e3cc9a5db8359a425c8da7039dae0d
-
memory/860-114-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/860-116-0x0000000005CD0000-0x0000000005CD1000-memory.dmpFilesize
4KB
-
memory/860-117-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/860-118-0x0000000005BD0000-0x0000000005BF2000-memory.dmpFilesize
136KB
-
memory/860-119-0x0000000006AA0000-0x0000000006AA1000-memory.dmpFilesize
4KB
-
memory/3280-120-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/3280-121-0x000000000046447E-mapping.dmp
-
memory/3280-127-0x00000000055D0000-0x0000000005ACE000-memory.dmpFilesize
5.0MB
-
memory/3280-128-0x00000000068F0000-0x00000000068F1000-memory.dmpFilesize
4KB
-
memory/3280-129-0x00000000067C0000-0x00000000067C1000-memory.dmpFilesize
4KB
-
memory/3280-130-0x0000000006760000-0x0000000006761000-memory.dmpFilesize
4KB