Analysis
-
max time kernel
81s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
22-07-2021 12:36
Static task
static1
Behavioral task
behavioral1
Sample
Bank contract,PDF.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Bank contract,PDF.exe
Resource
win10v20210408
General
-
Target
Bank contract,PDF.exe
-
Size
626KB
-
MD5
78015f9defe5b97192708769bd57afc3
-
SHA1
c415ba40d88e682fc6aaf2932ab598b1c3f2aeb6
-
SHA256
b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60
-
SHA512
08686d0638bdba03718c2739ecc98f8f8aa9dc97358f377ab2586d0b81f62461c7ec8e1b2f4c9ff3d69a96934c8f1eafe3b73f059bdf1ff14172730d22a7fd20
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.yandex.ru - Port:
465 - Username:
[email protected] - Password:
Bigman@2021pc
https://api.telegram.org/bot1845238130:AAHi6gsFs5hUVM4gq6AZswKJ0BHdbnMgjsI/sendMessage?chat_id=Draww72Bot
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bank contract,PDF.exedescription pid process target process PID 632 set thread context of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4028 1944 WerFault.exe Bank contract,PDF.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Bank contract,PDF.exeBank contract,PDF.exeWerFault.exepid process 632 Bank contract,PDF.exe 1944 Bank contract,PDF.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe 4028 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Bank contract,PDF.exeBank contract,PDF.exeWerFault.exedescription pid process Token: SeDebugPrivilege 632 Bank contract,PDF.exe Token: SeDebugPrivilege 1944 Bank contract,PDF.exe Token: SeRestorePrivilege 4028 WerFault.exe Token: SeBackupPrivilege 4028 WerFault.exe Token: SeDebugPrivilege 4028 WerFault.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Bank contract,PDF.exedescription pid process target process PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe PID 632 wrote to memory of 1944 632 Bank contract,PDF.exe Bank contract,PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"C:\Users\Admin\AppData\Local\Temp\Bank contract,PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 14563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Bank contract,PDF.exe.logMD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
memory/632-121-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/632-117-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/632-118-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/632-119-0x0000000005270000-0x000000000576E000-memory.dmpFilesize
5.0MB
-
memory/632-120-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/632-122-0x0000000006D70000-0x0000000006D8B000-memory.dmpFilesize
108KB
-
memory/632-123-0x0000000001180000-0x00000000011E4000-memory.dmpFilesize
400KB
-
memory/632-124-0x0000000000FA0000-0x0000000000FC5000-memory.dmpFilesize
148KB
-
memory/632-116-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/1944-125-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1944-126-0x000000000041F8AE-mapping.dmp
-
memory/1944-132-0x0000000004FC0000-0x00000000054BE000-memory.dmpFilesize
5.0MB