Analysis
- max time kernel
121s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
25/11/2021, 06:32
General
- Target 464144898 Docs.exe
- Size 636KB
- Sample211125-hamvdaedfk
- SHA256 551ba1376b60bc3db5419ed3bf6f174d6ed86e54aee8c85058944df5b22e525e
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
krsmakina.com
-
Port
587
-
Username
-
Password
9Kk~b[2G^F?e
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\464144898 Docs.exe"C:\Users\Admin\AppData\Local\Temp\464144898 Docs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AEFyQvzIHbdrf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AEFyQvzIHbdrf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5A12.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\464144898 Docs.exe"C:\Users\Admin\AppData\Local\Temp\464144898 Docs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/344-151-0x0000000006480000-0x0000000006481000-memory.dmp
memory/344-135-0x0000000000400000-0x0000000000426000-memory.dmp
memory/344-148-0x0000000005110000-0x000000000560E000-memory.dmp
memory/2692-123-0x0000000004FA0000-0x0000000004FA8000-memory.dmp
memory/2692-126-0x0000000005BA0000-0x0000000005BA1000-memory.dmp
memory/2692-127-0x0000000005C40000-0x0000000005CAA000-memory.dmp
memory/2692-118-0x00000000004D0000-0x00000000004D1000-memory.dmp
memory/2692-125-0x0000000004D30000-0x000000000522E000-memory.dmp
memory/2692-124-0x0000000005830000-0x0000000005831000-memory.dmp
memory/2692-122-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/2692-121-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/2692-120-0x0000000005230000-0x0000000005231000-memory.dmp
memory/3668-150-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/3668-132-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/3668-142-0x0000000006BA0000-0x0000000006BA1000-memory.dmp
memory/3668-143-0x0000000006E20000-0x0000000006E21000-memory.dmp
memory/3668-144-0x0000000007580000-0x0000000007581000-memory.dmp
memory/3668-145-0x00000000075F0000-0x00000000075F1000-memory.dmp
memory/3668-147-0x00000000068A2000-0x00000000068A3000-memory.dmp
memory/3668-146-0x00000000068A0000-0x00000000068A1000-memory.dmp
memory/3668-131-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/3668-149-0x0000000006DE0000-0x0000000006DE1000-memory.dmp
memory/3668-134-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/3668-130-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/3668-153-0x0000000007C30000-0x0000000007C31000-memory.dmp
memory/3668-155-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/3668-162-0x0000000008A20000-0x0000000008A53000-memory.dmp
memory/3668-169-0x0000000008A00000-0x0000000008A01000-memory.dmp
memory/3668-174-0x0000000008D60000-0x0000000008D61000-memory.dmp
memory/3668-175-0x0000000008F30000-0x0000000008F31000-memory.dmp
memory/3668-244-0x000000007F380000-0x000000007F381000-memory.dmp
memory/3668-245-0x00000000068A3000-0x00000000068A4000-memory.dmp