Analysis
- max time kernel
120s - max time network
129s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
11/11/2021, 16:30
General
- Target iAtFmoJMzuIesfc.exe
- Size 396KB
- Sample211111-tzt6jaggbk
- SHA256 a5873f85a8a3800eb3385730aa55e42df0e5a420b6d7bdfb7934a0872faebd4a
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.algodontekstil.com
-
Port
587
-
Username
-
Password
Alg001453
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nHBRHwWqEw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nHBRHwWqEw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD1E2.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"C:\Users\Admin\AppData\Local\Temp\iAtFmoJMzuIesfc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 14963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1072-131-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1072-143-0x0000000004D20000-0x0000000004DBC000-memory.dmp
memory/1508-119-0x0000000005140000-0x000000000563E000-memory.dmp
memory/1508-123-0x0000000008960000-0x000000000899C000-memory.dmp
memory/1508-115-0x0000000000750000-0x0000000000751000-memory.dmp
memory/1508-122-0x00000000089B0000-0x00000000089B1000-memory.dmp
memory/1508-121-0x0000000005470000-0x0000000005477000-memory.dmp
memory/1508-120-0x0000000005120000-0x0000000005121000-memory.dmp
memory/1508-118-0x0000000005140000-0x0000000005141000-memory.dmp
memory/1508-117-0x0000000005640000-0x0000000005641000-memory.dmp
memory/2132-145-0x0000000007320000-0x0000000007321000-memory.dmp
memory/2132-129-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
memory/2132-126-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/2132-138-0x0000000006A10000-0x0000000006A11000-memory.dmp
memory/2132-139-0x0000000006BB0000-0x0000000006BB1000-memory.dmp
memory/2132-140-0x0000000004320000-0x0000000004321000-memory.dmp
memory/2132-127-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/2132-142-0x0000000006C60000-0x0000000006C61000-memory.dmp
memory/2132-141-0x0000000004322000-0x0000000004323000-memory.dmp
memory/2132-144-0x00000000074E0000-0x00000000074E1000-memory.dmp
memory/2132-130-0x0000000006CD0000-0x0000000006CD1000-memory.dmp
memory/2132-146-0x00000000078B0000-0x00000000078B1000-memory.dmp
memory/2132-147-0x0000000007BE0000-0x0000000007BE1000-memory.dmp
memory/2132-148-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/2132-155-0x0000000008930000-0x0000000008963000-memory.dmp
memory/2132-162-0x0000000008910000-0x0000000008911000-memory.dmp
memory/2132-167-0x0000000008A70000-0x0000000008A71000-memory.dmp
memory/2132-168-0x0000000008E50000-0x0000000008E51000-memory.dmp
memory/2132-235-0x000000007F2B0000-0x000000007F2B1000-memory.dmp
memory/2132-237-0x0000000004323000-0x0000000004324000-memory.dmp