Analysis
- max time kernel
73s - max time network
119s - platform
windows7_x64 - resource
win7v20210410 - submitted
12/08/2021, 06:10
General
- Target BE-IZ-Q-1278-21 - COMMERCIAL.exe
- Size 1.3MB
- Sample210812-mpr28cd13n
- SHA256 522ef9da580292e5ef0de44c4c3522f8f4fea1f4248467ff66a7d638be7a305c
Score
10/10
Malware Config
Extracted
Family
-
snakekeylogger
Credentials
-
Protocol
smtp
-
Host
smtp.fireacoustics.com
-
Port
587
-
Username
-
Password
_d:rzD~62Jxh
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BE-IZ-Q-1278-21 - COMMERCIAL.exe"C:\Users\Admin\AppData\Local\Temp\BE-IZ-Q-1278-21 - COMMERCIAL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1768-66-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1768-68-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1768-70-0x0000000004910000-0x0000000004911000-memory.dmp
memory/2020-60-0x0000000001290000-0x0000000001291000-memory.dmp
memory/2020-62-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/2020-63-0x0000000000300000-0x0000000000318000-memory.dmp
memory/2020-64-0x0000000005340000-0x00000000053C6000-memory.dmp
memory/2020-65-0x0000000000620000-0x0000000000641000-memory.dmp