Analysis
- max time kernel
127s - max time network
133s - platform
windows7_x64 - resource
win7v20210408 - submitted
30/08/2021, 07:42
General
- Target 5f04f443d30eb1ff89bf3acaffbc5d72.exe
- Size 1016KB
- Sample210830-dlnbrn34mn
- SHA256 8357ddd0adcd00a22b6c8d30af16c9e5d44014e98396d16ad336c4495e9b70a6
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot1880141509:AAHjseWsCVnzygKB72YGbdj6S0DpdeKfGSs/sendMessage?chat_id=565072597
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f04f443d30eb1ff89bf3acaffbc5d72.exe"C:\Users\Admin\AppData\Local\Temp\5f04f443d30eb1ff89bf3acaffbc5d72.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5f04f443d30eb1ff89bf3acaffbc5d72.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5f04f443d30eb1ff89bf3acaffbc5d72.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1036-60-0x0000000000010000-0x0000000000011000-memory.dmp
memory/1036-62-0x00000000043A0000-0x00000000043A1000-memory.dmp
memory/1036-63-0x0000000000340000-0x000000000034E000-memory.dmp
memory/1036-64-0x0000000005E20000-0x0000000005EA2000-memory.dmp
memory/1036-65-0x0000000004BC0000-0x0000000004BF9000-memory.dmp
memory/1352-66-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1352-68-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1352-70-0x0000000000540000-0x0000000000541000-memory.dmp