Analysis
- max time kernel
56s - max time network
112s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/07/2021, 05:12
General
- Target Saudi aramco tender documents-BOQ and ITB.exe
- Size 1.3MB
- Sample210706-y2s33sw7ca
- SHA256 b0c975b40f8a8f52aa372b0eea9ce604f35b9e5101b4aada3fda0cbb2e25229b
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
smtp.uniwellfittings.com
-
Port
587
-
Username
-
Password
MNr3l:_urr2{
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Saudi aramco tender documents-BOQ and ITB.exe"C:\Users\Admin\AppData\Local\Temp\Saudi aramco tender documents-BOQ and ITB.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3352-125-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3352-133-0x0000000006790000-0x0000000006791000-memory.dmp
memory/3352-131-0x0000000003080000-0x0000000003081000-memory.dmp
memory/3896-121-0x00000000052E0000-0x00000000057DE000-memory.dmp
memory/3896-120-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmp
memory/3896-122-0x0000000005770000-0x000000000577F000-memory.dmp
memory/3896-123-0x0000000009AC0000-0x0000000009B26000-memory.dmp
memory/3896-124-0x000000000C220000-0x000000000C252000-memory.dmp
memory/3896-119-0x0000000005250000-0x0000000005251000-memory.dmp
memory/3896-118-0x00000000052E0000-0x00000000052E1000-memory.dmp
memory/3896-117-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/3896-116-0x0000000005180000-0x0000000005181000-memory.dmp