Analysis
- max time kernel
47s - max time network
113s - platform
windows10_x64 - resource
win10v20210410 - submitted
02/08/2021, 10:50
General
- Target CTM request ETA 2 August 2021.pdf.exe
- Size 1.2MB
- Sample210802-pl1csxrr1a
- SHA256 b7856dfff5b577d108b34cbc1761a8434311fe1ab3d1e47f9bc2558e6bbd3782
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.sacauto.co.za
-
Port
587
-
Username
-
Password
#R0797967613
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CTM request ETA 2 August 2021.pdf.exe"C:\Users\Admin\AppData\Local\Temp\CTM request ETA 2 August 2021.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 14003⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2112-114-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/2112-116-0x0000000005920000-0x0000000005921000-memory.dmp
memory/2112-117-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/2112-118-0x0000000005400000-0x0000000005401000-memory.dmp
memory/2112-119-0x0000000005780000-0x0000000005781000-memory.dmp
memory/2112-120-0x0000000005420000-0x000000000591E000-memory.dmp
memory/2112-121-0x0000000002E80000-0x0000000002E8D000-memory.dmp
memory/2112-122-0x000000000B630000-0x000000000B6B8000-memory.dmp
memory/2112-123-0x0000000006F20000-0x0000000006F42000-memory.dmp
memory/3652-124-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3652-130-0x0000000004DF0000-0x00000000052EE000-memory.dmp