Overview

overview

10

Static

static

INQUIRY RE...ia.exe

windows7_x64

10

INQUIRY RE...ia.exe

windows10_x64

10

Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-06-2021 03:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    INQUIRY REQUEST FOR QUOTATION Speedwell India.exe

  • Size

    1.4MB

  • MD5

    9bfe6b1554fd30018894d120a41f4816

  • SHA1

    c1164ecb978384a43e5a94bb006662f558c602cc

  • SHA256

    eb484e882001a70dbdd0d7d09c9d39b344592e98795e2a475dd636ce87bcc334

  • SHA512

    d91c5560f8b085a1b1e73c09f187a455babfa417efce1d3bb52e248718ec3786540cd3e285e9bf1c407ec957d186c02da4d9abbcdd649fac34ae181bb7bfcf12

Score
10/10
snakekeyloggerkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.totalkitchensandbathrooms.com.au
  • Port:
    587
  • Username:
    webmaster@totalkitchensandbathrooms.com.au
  • Password:
    iVp)4Im_5}(%

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe
    "C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yzUaGFYePcqi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA80D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:932
    • C:\Users\Admin\AppData\Local\Temp\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1264

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INQUIRY REQUEST FOR QUOTATION Speedwell India.exe.log
    MD5

    e66606ac29605c55484b2e0f9ee4a447

    SHA1

    4e226b60592e1addafae55034137ea8d5d0fb113

    SHA256

    51ea67e4068c37a73d878dfda2e9475e7ecb01ea5c422b13b71459db2d0942e9

    SHA512

    038139d200ba48d82a462dee57bab1dd0ca6d8180e20aef72b5d079c6010ce8d1041fbb49084e54deb205bcb9bf7ae92c6b6a0256908b48d08e5043e2148799b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\tmpA80D.tmp
    MD5

    f7408ed00a82b74e10f566c78dbdf855

    SHA1

    56ac4a22cec19f08e48ce47ccab2c6a47eb49336

    SHA256

    1ede5e6ff26c9d2f4c6bd90a02882d85dfc13336b5c0dc39b22f3764fa862e78

    SHA512

    c6c060d2e6264cdc5bd73d503de82973cdbc1fb3462749f534e28515c5e590a7c2be859ce23d808783ec54e650390ae13f8c4b3d191b75698dde39cbc49ed431

    Download Submit
  • memory/932-124-0x0000000000000000-mapping.dmp
    Download
  • memory/1264-135-0x0000000006C00000-0x0000000006C01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1264-133-0x0000000005770000-0x0000000005C6E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/1264-127-0x000000000041F9BE-mapping.dmp
    Download
  • memory/1264-126-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

    Download
  • memory/3540-119-0x0000000008180000-0x0000000008181000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3540-123-0x0000000001AC0000-0x0000000001AE1000-memory.dmp
    Filesize

    132KB

    Download
  • memory/3540-122-0x000000000BA40000-0x000000000BAAB000-memory.dmp
    Filesize

    428KB

    Download
  • memory/3540-121-0x0000000008550000-0x0000000008552000-memory.dmp
    Filesize

    8KB

    Download
  • memory/3540-120-0x0000000003390000-0x0000000003391000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3540-114-0x0000000000F60000-0x0000000000F61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3540-118-0x00000000082D0000-0x00000000082D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3540-117-0x0000000008190000-0x0000000008191000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3540-116-0x00000000085B0000-0x00000000085B1000-memory.dmp
    Filesize

    4KB

    Download