Analysis
- max time kernel
149s - max time network
161s - platform
windows10_x64 - resource
win10v20210408 - submitted
06/08/2021, 13:31
General
- Target Po 08062021.exe
- Size 834KB
- Sample210806-dr4cfgt8mx
- SHA256 90d00d97833d65bb0bea7fa86afb3d311a66069c80acaf18ca32055ad6b307f7
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.diktasltd.com.tr
-
Port
587
-
Username
-
Password
y7W3-vH?3{7C
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.diktasltd.com.tr
-
Port
587
-
Username
-
Password
y7W3-vH?3{7C
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Disables RegEdit via registry modification
- Disables Task Manager via registry modification
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Po 08062021.exe"C:\Users\Admin\AppData\Local\Temp\Po 08062021.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- Modifies registry key
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4648-121-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/4648-117-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/4648-118-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/4648-119-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/4648-120-0x0000000005250000-0x0000000005251000-memory.dmp
memory/4648-114-0x0000000000690000-0x0000000000691000-memory.dmp
memory/4648-122-0x00000000070E0000-0x00000000070F3000-memory.dmp
memory/4648-123-0x0000000008B80000-0x0000000008C04000-memory.dmp
memory/4648-124-0x000000000B370000-0x000000000B393000-memory.dmp
memory/4648-125-0x0000000002860000-0x0000000002881000-memory.dmp
memory/4648-126-0x000000000EC50000-0x000000000EC51000-memory.dmp
memory/4648-116-0x0000000005050000-0x0000000005051000-memory.dmp
memory/4648-128-0x0000000008F50000-0x0000000008F51000-memory.dmp