Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-06-2021 06:16
General
-
Target
quotation #60321.exe
-
Size
585KB
-
MD5
fed34025cb3d3cf2fe9f0e87160c1483
-
SHA1
b724297b281866d6871b35c232befc7902e6868f
-
SHA256
86588eae3bae93b8c0cad5c11658411ec1f298dbb98875edcebe8e079fd9aa85
-
SHA512
907e8fcb704e34f06577d322e198d36c0422d58cb76f790683be77b5ba173d288ff7e867d9a3fe38369230709a13dff20b119ba7e36b3311066df92be6d07cf2
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.tokasecurity.co.za - Port:
587 - Username:
toka.b@tokasecurity.co.za - Password:
Bafo1970@1
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quotation #60321.exe"C:\Users\Admin\AppData\Local\Temp\quotation #60321.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cuePLsAWC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF7C3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\quotation #60321.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF7C3.tmpMD5
7078fd75321fb214c4895ff1549881a4
SHA18b6b404e18b1e5925458088b4777f6fe81a91b13
SHA2567fae2758c6d51a55e029125135796886c4f2e0a9572d95956646682b63450534
SHA512496a5b3eb033f8bf5e3ac42e42b47583383c182a694045646029ab6222fd0c14aa477b8889ed98c77163010af576cf17c6e337b67c749a7881c801ef20611b6d
-
memory/740-121-0x00000000056E0000-0x00000000056E2000-memory.dmpFilesize
8KB
-
memory/740-123-0x000000000B2A0000-0x000000000B2CD000-memory.dmpFilesize
180KB
-
memory/740-118-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/740-119-0x0000000005260000-0x000000000575E000-memory.dmpFilesize
5.0MB
-
memory/740-120-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/740-114-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/740-122-0x0000000007110000-0x0000000007187000-memory.dmpFilesize
476KB
-
memory/740-117-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/740-116-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/1188-126-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1188-127-0x000000000041F8BE-mapping.dmp
-
memory/1188-132-0x00000000050E0000-0x00000000055DE000-memory.dmpFilesize
5.0MB
-
memory/1188-133-0x00000000064F0000-0x00000000064F1000-memory.dmpFilesize
4KB
-
memory/2812-124-0x0000000000000000-mapping.dmp