Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
shipment docu..exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
shipment docu..exe
Resource
win10-en-20211014
General
-
Target
shipment docu..exe
-
Size
22KB
-
MD5
75b7a294df955b78f7adf5882e600273
-
SHA1
df8f94ca5d228dcbda81efd0f8a0f37ff5ffa459
-
SHA256
d3c93ce13c0f0a8dd07512cb0cf5ca7474983e15e136022cd98c4ab9b6063bd4
-
SHA512
7b4c28d71348e798f3ddc7084767424754556a02a436b91e7516408b75031df32b4ba08fc60d658aeb381538c89bdf867373127ef29f6b03ec1ece56cf2e6da6
Malware Config
Extracted
Protocol: smtp- Host:
mail.faks-allied-health.com - Port:
587 - Username:
[email protected] - Password:
$Faks1234
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.faks-allied-health.com - Port:
587 - Username:
[email protected] - Password:
$Faks1234
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
shipment docu..exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 shipment docu..exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 shipment docu..exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 shipment docu..exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 checkip.dyndns.org 29 freegeoip.app 30 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
shipment docu..exedescription pid process target process PID 2680 set thread context of 2508 2680 shipment docu..exe shipment docu..exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
shipment docu..exeshipment docu..exepid process 2680 shipment docu..exe 2680 shipment docu..exe 2508 shipment docu..exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shipment docu..exeshipment docu..exedescription pid process Token: SeDebugPrivilege 2680 shipment docu..exe Token: SeDebugPrivilege 2508 shipment docu..exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
shipment docu..exedescription pid process target process PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe PID 2680 wrote to memory of 2508 2680 shipment docu..exe shipment docu..exe -
outlook_office_path 1 IoCs
Processes:
shipment docu..exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 shipment docu..exe -
outlook_win_path 1 IoCs
Processes:
shipment docu..exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 shipment docu..exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipment docu..exe"C:\Users\Admin\AppData\Local\Temp\shipment docu..exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\shipment docu..exe"C:\Users\Admin\AppData\Local\Temp\shipment docu..exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipment docu..exe.logMD5
808e884c00533a9eb0e13e64960d9c3a
SHA1279d05181fc6179a12df1a669ff5d8b64c1380ae
SHA2562f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6
SHA5129489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299
-
memory/2508-127-0x0000000004BA0000-0x000000000509E000-memory.dmpFilesize
5.0MB
-
memory/2508-120-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-121-0x00000000004203DE-mapping.dmp
-
memory/2508-125-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2508-126-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/2508-128-0x0000000005FF0000-0x0000000005FF1000-memory.dmpFilesize
4KB
-
memory/2508-129-0x0000000006260000-0x0000000006261000-memory.dmpFilesize
4KB
-
memory/2508-130-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB
-
memory/2680-118-0x0000000006520000-0x000000000655F000-memory.dmpFilesize
252KB
-
memory/2680-119-0x00000000065E0000-0x00000000065F8000-memory.dmpFilesize
96KB
-
memory/2680-117-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/2680-115-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB