Analysis
-
max time kernel
73s -
max time network
74s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 12:36
Static task
static1
Behavioral task
behavioral1
Sample
Bank contract,PDF.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Bank contract,PDF.exe
Resource
win10v20210408
General
-
Target
Bank contract,PDF.exe
-
Size
626KB
-
MD5
78015f9defe5b97192708769bd57afc3
-
SHA1
c415ba40d88e682fc6aaf2932ab598b1c3f2aeb6
-
SHA256
b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60
-
SHA512
08686d0638bdba03718c2739ecc98f8f8aa9dc97358f377ab2586d0b81f62461c7ec8e1b2f4c9ff3d69a96934c8f1eafe3b73f059bdf1ff14172730d22a7fd20
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.yandex.ru - Port:
465 - Username:
[email protected] - Password:
Bigman@2021pc
https://api.telegram.org/bot1845238130:AAHi6gsFs5hUVM4gq6AZswKJ0BHdbnMgjsI/sendMessage?chat_id=Draww72Bot
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 freegeoip.app 11 freegeoip.app 5 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bank contract,PDF.exedescription pid process target process PID 788 set thread context of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Bank contract,PDF.exepid process 1016 Bank contract,PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Bank contract,PDF.exedescription pid process Token: SeDebugPrivilege 1016 Bank contract,PDF.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Bank contract,PDF.exedescription pid process target process PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe PID 788 wrote to memory of 1016 788 Bank contract,PDF.exe Bank contract,PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/788-60-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/788-62-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/788-63-0x0000000000490000-0x00000000004AB000-memory.dmpFilesize
108KB
-
memory/788-64-0x0000000004FB0000-0x0000000005014000-memory.dmpFilesize
400KB
-
memory/788-65-0x0000000002090000-0x00000000020B5000-memory.dmpFilesize
148KB
-
memory/1016-66-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1016-67-0x000000000041F8AE-mapping.dmp
-
memory/1016-68-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1016-70-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB