Analysis
-
max time kernel
101s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-06-2021 09:02
Static task
static1
Behavioral task
behavioral1
Sample
WQ090090.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
WQ090090.exe
Resource
win10v20210410
General
-
Target
WQ090090.exe
-
Size
630KB
-
MD5
63e701517f119a37e2bfb0326f2f7851
-
SHA1
aeccae0b7c91487fa9a403abd4afdc37653d88a4
-
SHA256
d373c0339517c98ee8668e152f5e0987acb36409fb33026d0bab053b84ac6d89
-
SHA512
02e24b6ed7d71051416919b68cb7b65238ed5ac6e03a3478b9e7f1ccb43319cf4d3028b8a3151e2f6fd9911fc963c89f9a35ef276ceb57099d0aa310b828670c
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1483662500:AAGrMuxJV05-It-ke-xXVV6-R6IAtETpJb0/sendMessage?chat_id=1300181783
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1344-117-0x0000000000400000-0x000000000046A000-memory.dmp family_snakekeylogger behavioral2/memory/1344-121-0x0000000004E40000-0x000000000533E000-memory.dmp family_snakekeylogger -
Loads dropped DLL 2 IoCs
Processes:
WQ090090.exepid process 4016 WQ090090.exe 4016 WQ090090.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
WQ090090.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\enhrsd = "C:\\Users\\Admin\\AppData\\Roaming\\thfyvsekmqds\\goclnv.exe" WQ090090.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 freegeoip.app 13 freegeoip.app 9 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
WQ090090.exedescription pid process target process PID 4016 set thread context of 1344 4016 WQ090090.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
WQ090090.exeMSBuild.exepid process 4016 WQ090090.exe 4016 WQ090090.exe 4016 WQ090090.exe 4016 WQ090090.exe 4016 WQ090090.exe 4016 WQ090090.exe 4016 WQ090090.exe 4016 WQ090090.exe 1344 MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
WQ090090.exepid process 4016 WQ090090.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1344 MSBuild.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WQ090090.exedescription pid process target process PID 4016 wrote to memory of 1344 4016 WQ090090.exe MSBuild.exe PID 4016 wrote to memory of 1344 4016 WQ090090.exe MSBuild.exe PID 4016 wrote to memory of 1344 4016 WQ090090.exe MSBuild.exe PID 4016 wrote to memory of 1344 4016 WQ090090.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WQ090090.exe"C:\Users\Admin\AppData\Local\Temp\WQ090090.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\WQ090090.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nse1E8B.tmp\System.dllMD5
56a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
\Users\Admin\AppData\Local\Temp\nse1E8B.tmp\System.dllMD5
56a321bd011112ec5d8a32b2f6fd3231
SHA1df20e3a35a1636de64df5290ae5e4e7572447f78
SHA256bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
SHA5125354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
-
memory/1344-116-0x000000000046447E-mapping.dmp
-
memory/1344-117-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1344-119-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/1344-120-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/1344-122-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/1344-121-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/1344-123-0x0000000005D20000-0x0000000005D21000-memory.dmpFilesize
4KB
-
memory/1344-124-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB