Overview

overview

10

Static

static

fatura.exe

windows7_x64

10

fatura.exe

windows10_x64

10

Analysis

  • max time kernel
    63s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27-07-2021 21:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fatura.exe

  • Size

    1.1MB

  • MD5

    6a9d0ec45e52137abf05b546151dc664

  • SHA1

    2ea215c3bac1316746fb0ddb9ad7be216a596220

  • SHA256

    9c247a73a2b93a70b14c37b1dbf564f38db8bb9a0e7160de1971655a4e02950a

  • SHA512

    4b0a78c6da7c010c81d36d1e9ae70b60059e1e19b589221329bb447d798db0b36015e07fe7c282fc0250b409845376dd8e1651725cd8783883084d9891de994e

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.ergrafica.com.ar
  • Port:
    587
  • Username:
    trabajos@ergrafica.com.ar
  • Password:
    25834931Cecilia

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fatura.exe
    "C:\Users\Admin\AppData\Local\Temp\fatura.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\fatura.exe
      "C:\Users\Admin\AppData\Local\Temp\fatura.exe"
      2⤵
        PID:316
      • C:\Users\Admin\AppData\Local\Temp\fatura.exe
        "C:\Users\Admin\AppData\Local\Temp\fatura.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
          dw20.exe -x -s 964
          3⤵
            PID:904

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/640-59-0x0000000074F31000-0x0000000074F33000-memory.dmp
        Filesize

        8KB

        Download
      • memory/640-60-0x0000000002090000-0x0000000002091000-memory.dmp
        Filesize

        4KB

        Download
      • memory/640-61-0x0000000002091000-0x0000000002092000-memory.dmp
        Filesize

        4KB

        Download
      • memory/904-66-0x0000000000000000-mapping.dmp
        Download
      • memory/904-68-0x00000000023A0000-0x00000000023A1000-memory.dmp
        Filesize

        4KB

        Download
      • memory/992-62-0x0000000000400000-0x0000000000448000-memory.dmp
        Filesize

        288KB

        Download
      • memory/992-63-0x000000000044285E-mapping.dmp
        Download
      • memory/992-65-0x0000000002360000-0x0000000002361000-memory.dmp
        Filesize

        4KB

        Download