Analysis
-
max time kernel
59s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
21-10-2021 17:58
General
-
Target
AMENDED INVOICE & COO DOCS.exe
-
Size
415KB
-
MD5
d693f58558538c9e8daf36fbd374db55
-
SHA1
25f77f246f27956647f2d4ddab85da100431d129
-
SHA256
01cccbd3a723331004dbf8de510380d5c328b8f3d8ae936fb4b9dd4f6259e532
-
SHA512
dc6cc23407f4a25645704202e6b81dd092a972bd7c5123612fed9d3bfc57823534ad443c036f70f1e843891b3dc7f977f002561de2292f2ea7fd1dda8f1e68cb
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendMessage?chat_id=1063661839
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AMENDED INVOICE & COO DOCS.exe"C:\Users\Admin\AppData\Local\Temp\AMENDED INVOICE & COO DOCS.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AMENDED INVOICE & COO DOCS.exe"C:\Users\Admin\AppData\Local\Temp\AMENDED INVOICE & COO DOCS.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AMENDED INVOICE & COO DOCS.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/2248-133-0x0000000000000000-mapping.dmp
-
memory/2844-124-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2844-134-0x0000000006A60000-0x0000000006A61000-memory.dmpFilesize
4KB
-
memory/2844-131-0x00000000054D0000-0x00000000059CE000-memory.dmpFilesize
5.0MB
-
memory/2844-125-0x000000000042012E-mapping.dmp
-
memory/3940-119-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/3940-123-0x00000000066A0000-0x00000000066E1000-memory.dmpFilesize
260KB
-
memory/3940-122-0x0000000006600000-0x0000000006601000-memory.dmpFilesize
4KB
-
memory/3940-121-0x00000000062D0000-0x00000000062D7000-memory.dmpFilesize
28KB
-
memory/3940-120-0x00000000058A0000-0x0000000005D9E000-memory.dmpFilesize
5.0MB
-
memory/3940-115-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/3940-118-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/3940-117-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB