Overview

overview

10

Static

static

wire_pmt_d...df.exe

windows7_x64

10

wire_pmt_d...df.exe

windows10_x64

10

Analysis

  • max time kernel
    73s
  • max time network
    74s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    21-06-2021 06:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wire_pmt_details_6212021,pdf.exe

  • Size

    695KB

  • MD5

    e57cda842a821935f5819f7a861d1bcc

  • SHA1

    053877f119d842e91d62af1e9082ac7b7222ad8d

  • SHA256

    619d47029ebd28342d5a099b67d7eece183a4424d63b56abf66a7fe25169fca0

  • SHA512

    1905ed39ca480526ce1d146fa7a316fe6856d1433238881c2748325ac8792da534e7fa0a6dd335c97b3f3e801f2382a7481113c41f2371eb68c5a16ba884f442

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.privateemail.com
  • Port:
    587
  • Username:
    nicolas.sautter@chsauter-bc.com
  • Password:
    111aaa

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger Payload 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wire_pmt_details_6212021,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\wire_pmt_details_6212021,pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\wire_pmt_details_6212021,pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\wire_pmt_details_6212021,pdf.exe"
      2⤵
        PID:792
      • C:\Users\Admin\AppData\Local\Temp\wire_pmt_details_6212021,pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\wire_pmt_details_6212021,pdf.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1072

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1072-66-0x0000000000400000-0x000000000046A000-memory.dmp
      Filesize

      424KB

      Download
    • memory/1072-67-0x000000000046457E-mapping.dmp
      Download
    • memory/1072-68-0x0000000000400000-0x000000000046A000-memory.dmp
      Filesize

      424KB

      Download
    • memory/1072-70-0x0000000004C80000-0x0000000004C81000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1652-60-0x0000000001180000-0x0000000001181000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1652-62-0x0000000000B50000-0x0000000000B51000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1652-63-0x0000000000340000-0x0000000000350000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1652-64-0x00000000056A0000-0x0000000005713000-memory.dmp
      Filesize

      460KB

      Download
    • memory/1652-65-0x00000000057B0000-0x0000000005829000-memory.dmp
      Filesize

      484KB

      Download