Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
24-06-2021 03:24
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY REQUEST FOR QUOTATION Speedwell India.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
INQUIRY REQUEST FOR QUOTATION Speedwell India.exe
Resource
win10v20210410
General
-
Target
INQUIRY REQUEST FOR QUOTATION Speedwell India.exe
-
Size
1.4MB
-
MD5
9bfe6b1554fd30018894d120a41f4816
-
SHA1
c1164ecb978384a43e5a94bb006662f558c602cc
-
SHA256
eb484e882001a70dbdd0d7d09c9d39b344592e98795e2a475dd636ce87bcc334
-
SHA512
d91c5560f8b085a1b1e73c09f187a455babfa417efce1d3bb52e248718ec3786540cd3e285e9bf1c407ec957d186c02da4d9abbcdd649fac34ae181bb7bfcf12
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.totalkitchensandbathrooms.com.au - Port:
587 - Username:
webmaster@totalkitchensandbathrooms.com.au - Password:
iVp)4Im_5}(%
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 checkip.dyndns.org 11 freegeoip.app 12 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INQUIRY REQUEST FOR QUOTATION Speedwell India.exedescription pid process target process PID 1268 set thread context of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
INQUIRY REQUEST FOR QUOTATION Speedwell India.exeINQUIRY REQUEST FOR QUOTATION Speedwell India.exepid process 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe 804 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INQUIRY REQUEST FOR QUOTATION Speedwell India.exeINQUIRY REQUEST FOR QUOTATION Speedwell India.exedescription pid process Token: SeDebugPrivilege 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe Token: SeDebugPrivilege 804 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
INQUIRY REQUEST FOR QUOTATION Speedwell India.exedescription pid process target process PID 1268 wrote to memory of 940 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe schtasks.exe PID 1268 wrote to memory of 940 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe schtasks.exe PID 1268 wrote to memory of 940 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe schtasks.exe PID 1268 wrote to memory of 940 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe schtasks.exe PID 1268 wrote to memory of 568 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 568 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 568 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 568 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe PID 1268 wrote to memory of 804 1268 INQUIRY REQUEST FOR QUOTATION Speedwell India.exe INQUIRY REQUEST FOR QUOTATION Speedwell India.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yzUaGFYePcqi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp840E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp840E.tmpMD5
f571020acc35cfbd819a1e44410acf7e
SHA12a9ab266cf9cac8e8ed9b29d2fa7d746b3e287fc
SHA2565765f2f833bec514318f27ca49c2d1350cfafcf057e234e0405dfa4f6d8f08be
SHA512a004344bfef956a6a3cd4af8d9c85bd030798afc52111d34eb9c3fbe02768dcbb0218c259318161c31c5aa5b3f594220bd56de733ff7f822e5e0256cbfb8f391
-
memory/804-67-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/804-68-0x000000000041F9BE-mapping.dmp
-
memory/804-69-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/804-71-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/940-65-0x0000000000000000-mapping.dmp
-
memory/1268-59-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1268-61-0x0000000007040000-0x0000000007041000-memory.dmpFilesize
4KB
-
memory/1268-62-0x0000000000730000-0x0000000000732000-memory.dmpFilesize
8KB
-
memory/1268-63-0x0000000004AB0000-0x0000000004B1B000-memory.dmpFilesize
428KB
-
memory/1268-64-0x00000000022C0000-0x00000000022E1000-memory.dmpFilesize
132KB