Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
30-11-2021 16:48
Static task
static1
Behavioral task
behavioral1
Sample
GjcNWOvgPR2KiVV.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
GjcNWOvgPR2KiVV.exe
Resource
win10-en-20211104
General
-
Target
GjcNWOvgPR2KiVV.exe
-
Size
337KB
-
MD5
f25ad3b544326894e43402949ff39d63
-
SHA1
7d2759c0d52e12f9a45e9fa8d632633ea9b260d2
-
SHA256
c1780ef2dc13dc3b92eab8e08fb247e3caa62587bc0be3c6f5260f2b95450c3b
-
SHA512
c7fb409d5a9f9ab6b952d18b21fc29b11eb55b363f12bc9c73445887878d01de3b4380f197eaaa849edbaaccb2f6775c686e448c1f6d338b7667b2b45f60535f
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.turkal.com - Port:
587 - Username:
info@turkal.com - Password:
Turkal2020!
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
GjcNWOvgPR2KiVV.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 GjcNWOvgPR2KiVV.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 GjcNWOvgPR2KiVV.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 GjcNWOvgPR2KiVV.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 28 checkip.dyndns.org 30 freegeoip.app 31 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
GjcNWOvgPR2KiVV.exedescription pid process target process PID 4292 set thread context of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeGjcNWOvgPR2KiVV.exepid process 420 powershell.exe 1428 GjcNWOvgPR2KiVV.exe 420 powershell.exe 420 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeGjcNWOvgPR2KiVV.exedescription pid process Token: SeDebugPrivilege 420 powershell.exe Token: SeDebugPrivilege 1428 GjcNWOvgPR2KiVV.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
GjcNWOvgPR2KiVV.exedescription pid process target process PID 4292 wrote to memory of 420 4292 GjcNWOvgPR2KiVV.exe powershell.exe PID 4292 wrote to memory of 420 4292 GjcNWOvgPR2KiVV.exe powershell.exe PID 4292 wrote to memory of 420 4292 GjcNWOvgPR2KiVV.exe powershell.exe PID 4292 wrote to memory of 640 4292 GjcNWOvgPR2KiVV.exe schtasks.exe PID 4292 wrote to memory of 640 4292 GjcNWOvgPR2KiVV.exe schtasks.exe PID 4292 wrote to memory of 640 4292 GjcNWOvgPR2KiVV.exe schtasks.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe PID 4292 wrote to memory of 1428 4292 GjcNWOvgPR2KiVV.exe GjcNWOvgPR2KiVV.exe -
outlook_office_path 1 IoCs
Processes:
GjcNWOvgPR2KiVV.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 GjcNWOvgPR2KiVV.exe -
outlook_win_path 1 IoCs
Processes:
GjcNWOvgPR2KiVV.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 GjcNWOvgPR2KiVV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GjcNWOvgPR2KiVV.exe"C:\Users\Admin\AppData\Local\Temp\GjcNWOvgPR2KiVV.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mnPZjkmPGLsA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mnPZjkmPGLsA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp42B2.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\GjcNWOvgPR2KiVV.exe"C:\Users\Admin\AppData\Local\Temp\GjcNWOvgPR2KiVV.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp42B2.tmpMD5
1f98156108026eed46023e7e9bca6437
SHA132b0621f43703a9ed2cd5205536dca367d41bd54
SHA256a91408ca55a8523607ec5a1dd21fd8bf30f2d0e14f2c4ee44aecf380bfdd622c
SHA512f391ff61e9c5b94ac63de19371eb6def348cbe6f6573730ad78e9f519fa0d5982a6b03757b05217e59ced8e751014a06d963c2c10dbf22b9b8188566185609bf
-
memory/420-147-0x0000000007E10000-0x0000000007E11000-memory.dmpFilesize
4KB
-
memory/420-127-0x0000000000000000-mapping.dmp
-
memory/420-243-0x0000000006C93000-0x0000000006C94000-memory.dmpFilesize
4KB
-
memory/420-242-0x000000007E830000-0x000000007E831000-memory.dmpFilesize
4KB
-
memory/420-173-0x00000000094F0000-0x00000000094F1000-memory.dmpFilesize
4KB
-
memory/420-172-0x0000000009310000-0x0000000009311000-memory.dmpFilesize
4KB
-
memory/420-167-0x0000000008FB0000-0x0000000008FB1000-memory.dmpFilesize
4KB
-
memory/420-138-0x0000000007970000-0x0000000007971000-memory.dmpFilesize
4KB
-
memory/420-160-0x00000000091D0000-0x0000000009203000-memory.dmpFilesize
204KB
-
memory/420-140-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/420-130-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB
-
memory/420-131-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/420-153-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB
-
memory/420-133-0x00000000072D0000-0x00000000072D1000-memory.dmpFilesize
4KB
-
memory/420-134-0x0000000007170000-0x0000000007171000-memory.dmpFilesize
4KB
-
memory/420-150-0x00000000081F0000-0x00000000081F1000-memory.dmpFilesize
4KB
-
memory/420-148-0x00000000082D0000-0x00000000082D1000-memory.dmpFilesize
4KB
-
memory/420-145-0x0000000006C92000-0x0000000006C93000-memory.dmpFilesize
4KB
-
memory/420-129-0x0000000002DB0000-0x0000000002DB1000-memory.dmpFilesize
4KB
-
memory/420-143-0x0000000007AC0000-0x0000000007AC1000-memory.dmpFilesize
4KB
-
memory/420-144-0x0000000006C90000-0x0000000006C91000-memory.dmpFilesize
4KB
-
memory/640-128-0x0000000000000000-mapping.dmp
-
memory/1428-135-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1428-149-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/1428-146-0x0000000004D00000-0x00000000051FE000-memory.dmpFilesize
5.0MB
-
memory/1428-136-0x000000000042041E-mapping.dmp
-
memory/4292-118-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/4292-124-0x0000000005260000-0x0000000005266000-memory.dmpFilesize
24KB
-
memory/4292-121-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/4292-120-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/4292-125-0x0000000007270000-0x0000000007271000-memory.dmpFilesize
4KB
-
memory/4292-126-0x0000000007360000-0x00000000073AD000-memory.dmpFilesize
308KB
-
memory/4292-123-0x0000000004D90000-0x000000000528E000-memory.dmpFilesize
5.0MB
-
memory/4292-122-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB