Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-07-2021 08:34
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE NOPYN160917A-pdf.exe
Resource
win7v20210410
General
-
Target
INVOICE NOPYN160917A-pdf.exe
-
Size
1.5MB
-
MD5
2e4c84e9537be515d65b0bdd4d7f533a
-
SHA1
3105f4f8144acff5bc394d71bbf2caa0512ad438
-
SHA256
6dd20f1dac8777dde5b6e89fee5381be620203345520d0a6f2263fd1cf02e918
-
SHA512
de901d33dc31cc4b9bcc6db0aba1fda65be0282b206fb26bf066c740808bf899cd26b63636746925574d1efbe917564a010eece6fbc247633069f0ffb3537dc4
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
25 - Username:
[email protected] - Password:
BkKMmzZ1
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 checkip.dyndns.org 10 freegeoip.app 11 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INVOICE NOPYN160917A-pdf.exedescription pid process target process PID 456 set thread context of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
INVOICE NOPYN160917A-pdf.exepid process 940 INVOICE NOPYN160917A-pdf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
INVOICE NOPYN160917A-pdf.exeINVOICE NOPYN160917A-pdf.exedescription pid process Token: SeDebugPrivilege 456 INVOICE NOPYN160917A-pdf.exe Token: SeDebugPrivilege 940 INVOICE NOPYN160917A-pdf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
INVOICE NOPYN160917A-pdf.exedescription pid process target process PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe PID 456 wrote to memory of 940 456 INVOICE NOPYN160917A-pdf.exe INVOICE NOPYN160917A-pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE NOPYN160917A-pdf.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE NOPYN160917A-pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INVOICE NOPYN160917A-pdf.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE NOPYN160917A-pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-59-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB
-
memory/456-61-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/456-62-0x0000000000490000-0x00000000004BD000-memory.dmpFilesize
180KB
-
memory/456-63-0x0000000005460000-0x00000000054BF000-memory.dmpFilesize
380KB
-
memory/456-64-0x0000000000530000-0x0000000000551000-memory.dmpFilesize
132KB
-
memory/940-65-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/940-66-0x000000000041F89E-mapping.dmp
-
memory/940-67-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/940-69-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB