Analysis
- max time kernel
124s - max time network
127s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/09/2021, 06:22
General
- Target DHL AWB# 4AB19037XXX.pdf.exe
- Size 5KB
- Sample210929-g4xe8sdge6
- SHA256 f260c80e685986ac80122c63fcc494891baf4d688668da8f7fa11e38d7f8d1b8
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
smtp.alicoandsons.com
-
Port
587
-
Username
-
Password
Usman12345
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Downloads MZ/PE file
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB# 4AB19037XXX.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB# 4AB19037XXX.pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmp
memory/628-116-0x000000001AD00000-0x000000001AD02000-memory.dmp
memory/628-117-0x0000000002150000-0x0000000002161000-memory.dmp
memory/1872-118-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1872-122-0x0000000005380000-0x0000000005381000-memory.dmp
memory/1872-123-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/1872-124-0x0000000004E80000-0x000000000537E000-memory.dmp
memory/1872-125-0x0000000006050000-0x0000000006051000-memory.dmp
memory/1872-126-0x0000000005F20000-0x0000000005F21000-memory.dmp
memory/1872-127-0x0000000005EB0000-0x0000000005EB1000-memory.dmp