Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
01-12-2021 12:35
Static task
static1
Behavioral task
behavioral1
Sample
Statement.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
Statement.exe
Resource
win10-en-20211104
General
-
Target
Statement.exe
-
Size
571KB
-
MD5
9cee10955eb4330bfba8abb81d83cb98
-
SHA1
8c80ef728fec74d472edbac2fe8f5abb844a86b3
-
SHA256
b1aea37a6d2fdd3e3d8c646441891848969d92a2f4b88bfc084b4f7a51a88b28
-
SHA512
7de20802fca5abd5ac7f7a265cdcac97447619f6de039f965d15d4a6c03d23435eaa279e30c895807f93b823130928df9571b3f67db52f3eda80119e9cd8619b
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.agc.com.sa - Port:
587 - Username:
vijayakumar.singh@agc.com.sa - Password:
admin@admin$$
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 checkip.dyndns.org 27 freegeoip.app 28 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Statement.exedescription pid process target process PID 3768 set thread context of 3972 3768 Statement.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegSvcs.exepid process 3972 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 3972 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Statement.exedescription pid process target process PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe PID 3768 wrote to memory of 3972 3768 Statement.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Statement.exe"C:\Users\Admin\AppData\Local\Temp\Statement.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3768-118-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/3768-120-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/3768-121-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/3768-122-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/3768-123-0x0000000004BB0000-0x0000000004BB6000-memory.dmpFilesize
24KB
-
memory/3768-124-0x0000000004B20000-0x000000000501E000-memory.dmpFilesize
5.0MB
-
memory/3768-125-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/3768-126-0x0000000005A50000-0x0000000005A9B000-memory.dmpFilesize
300KB
-
memory/3972-128-0x000000000042044E-mapping.dmp
-
memory/3972-127-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3972-133-0x0000000005070000-0x000000000556E000-memory.dmpFilesize
5.0MB
-
memory/3972-134-0x00000000061C0000-0x00000000061C1000-memory.dmpFilesize
4KB