Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-06-2021 14:05
Static task
static1
Behavioral task
behavioral1
Sample
quote#2793 almaco.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
quote#2793 almaco.exe
Resource
win10v20210408
General
-
Target
quote#2793 almaco.exe
-
Size
537KB
-
MD5
e01f4ef489111632bad36cf50a31de59
-
SHA1
958d0b6d6b171e85c1ca96728aeb5c186feff22c
-
SHA256
b8902f524b2bbefb37fe0215cc36f8e022e29059cdb0a68a592326fb522066a1
-
SHA512
599e865a4f5f4121acb82d91ce53069efb18d52e9d676c12ae92c1cd63dbb6f3aa747ea3d859ae1fee7b198a7a49cfd71dc2a48556e183d8d59317c3026defe5
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.tokasecurity.co.za - Port:
587 - Username:
toka.b@tokasecurity.co.za - Password:
Bafo1970@1
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/2696-133-0x00000000051B0000-0x00000000056AE000-memory.dmp disable_win_def -
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 checkip.dyndns.org 16 freegeoip.app 17 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
quote#2793 almaco.exedescription pid process target process PID 3128 set thread context of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
quote#2793 almaco.exequote#2793 almaco.exepid process 3128 quote#2793 almaco.exe 3128 quote#2793 almaco.exe 3128 quote#2793 almaco.exe 3128 quote#2793 almaco.exe 3128 quote#2793 almaco.exe 2696 quote#2793 almaco.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
quote#2793 almaco.exequote#2793 almaco.exedescription pid process Token: SeDebugPrivilege 3128 quote#2793 almaco.exe Token: SeDebugPrivilege 2696 quote#2793 almaco.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
quote#2793 almaco.exedescription pid process target process PID 3128 wrote to memory of 2352 3128 quote#2793 almaco.exe schtasks.exe PID 3128 wrote to memory of 2352 3128 quote#2793 almaco.exe schtasks.exe PID 3128 wrote to memory of 2352 3128 quote#2793 almaco.exe schtasks.exe PID 3128 wrote to memory of 1308 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 1308 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 1308 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 3640 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 3640 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 3640 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe PID 3128 wrote to memory of 2696 3128 quote#2793 almaco.exe quote#2793 almaco.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\quote#2793 almaco.exe"C:\Users\Admin\AppData\Local\Temp\quote#2793 almaco.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jhHdAf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1379.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\quote#2793 almaco.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\quote#2793 almaco.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\quote#2793 almaco.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\quote#2793 almaco.exe.logMD5
c3cc52ccca9ff2b6fa8d267fc350ca6b
SHA1a68d4028333296d222e4afd75dea36fdc98d05f3
SHA2563125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e
SHA512b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7
-
C:\Users\Admin\AppData\Local\Temp\tmp1379.tmpMD5
8b84788c3bfb7a00cca879b3f0593783
SHA100933ee63eb5803589bf2a54f30b5c57eddf82af
SHA256da53144ce3d3b943b8741a3ca5a0d00c132e5ea5f002a44e30012bb3bce998ad
SHA512e58f19fabebac31c114d276127155aa503c7c5680bb73af9a183ea42513486078c9fe7e868a60bfb67b4392af34949460bd61474daf58288e115b0c6729a5aac
-
memory/2352-124-0x0000000000000000-mapping.dmp
-
memory/2696-134-0x0000000006590000-0x0000000006591000-memory.dmpFilesize
4KB
-
memory/2696-133-0x00000000051B0000-0x00000000056AE000-memory.dmpFilesize
5.0MB
-
memory/2696-127-0x000000000041F8BE-mapping.dmp
-
memory/2696-126-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3128-119-0x0000000004AB0000-0x0000000004FAE000-memory.dmpFilesize
5.0MB
-
memory/3128-123-0x0000000006900000-0x000000000692A000-memory.dmpFilesize
168KB
-
memory/3128-122-0x0000000006820000-0x000000000688E000-memory.dmpFilesize
440KB
-
memory/3128-121-0x0000000004D20000-0x0000000004D22000-memory.dmpFilesize
8KB
-
memory/3128-120-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3128-114-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/3128-118-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/3128-117-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/3128-116-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB