Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-07-2021 19:07

General

  • Target

    f223962d913a5a81a1e8ede9f2751d1b.exe

  • Size

    657KB

  • MD5

    f223962d913a5a81a1e8ede9f2751d1b

  • SHA1

    0d68ea4b1b2baac139cf78bad27918f864640061

  • SHA256

    edf4be11c04f2228e6448b9e771f3f8969e8bfcbf914252064c8ee07629c5f4a

  • SHA512

    8bfd30d10d8fe162a978529b30844bdd069f74e9fbb598bba89e5611352015838b5de068a0e932ebf91358256ef92424aad815436acee29504d89e4ce8b01dd1

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.ccsp-india.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Lkp$CcsP1008

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f223962d913a5a81a1e8ede9f2751d1b.exe
    "C:\Users\Admin\AppData\Local\Temp\f223962d913a5a81a1e8ede9f2751d1b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4020
    • C:\Users\Admin\AppData\Local\Temp\f223962d913a5a81a1e8ede9f2751d1b.exe
      "C:\Users\Admin\AppData\Local\Temp\f223962d913a5a81a1e8ede9f2751d1b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3760

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f223962d913a5a81a1e8ede9f2751d1b.exe.log

    MD5

    90acfd72f14a512712b1a7380c0faf60

    SHA1

    40ba4accb8faa75887e84fb8e38d598dc8cf0f12

    SHA256

    20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

    SHA512

    29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

  • memory/3760-125-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3760-133-0x0000000006500000-0x0000000006501000-memory.dmp

    Filesize

    4KB

  • memory/3760-132-0x0000000002B80000-0x0000000002B81000-memory.dmp

    Filesize

    4KB

  • memory/3760-126-0x000000000041F86E-mapping.dmp

  • memory/4020-121-0x0000000004C20000-0x000000000511E000-memory.dmp

    Filesize

    5.0MB

  • memory/4020-114-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/4020-122-0x0000000004F70000-0x0000000004F8B000-memory.dmp

    Filesize

    108KB

  • memory/4020-123-0x00000000070F0000-0x0000000007154000-memory.dmp

    Filesize

    400KB

  • memory/4020-124-0x0000000007180000-0x00000000071A5000-memory.dmp

    Filesize

    148KB

  • memory/4020-120-0x0000000004E40000-0x0000000004E41000-memory.dmp

    Filesize

    4KB

  • memory/4020-119-0x0000000004B30000-0x0000000004B31000-memory.dmp

    Filesize

    4KB

  • memory/4020-118-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

    Filesize

    4KB

  • memory/4020-117-0x0000000005120000-0x0000000005121000-memory.dmp

    Filesize

    4KB

  • memory/4020-116-0x0000000004B80000-0x0000000004B81000-memory.dmp

    Filesize

    4KB