Analysis
-
max time kernel
125s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
03-12-2021 15:52
Static task
static1
Behavioral task
behavioral1
Sample
ad28e18735d8e13304ef1adcf4218cec.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
ad28e18735d8e13304ef1adcf4218cec.exe
Resource
win10-en-20211014
General
-
Target
ad28e18735d8e13304ef1adcf4218cec.exe
-
Size
5.5MB
-
MD5
ad28e18735d8e13304ef1adcf4218cec
-
SHA1
45257ee12ddf488f56f3e41576f93fed12e6ce20
-
SHA256
95272a070df2cf2988d238138d1eadcfeffe68e311d904f83969b2fd71b62f60
-
SHA512
85d3e7ef25fa249cebd388fb3462db9d8139f25b8f86a9e1541b0b9c8642ec7c710aa4e07a75a89c9953d5e3b6ab96077a877fddce14db95717ed9814efad2a0
Malware Config
Extracted
Protocol: smtp- Host:
mail.nclanka.lk - Port:
587 - Username:
sales@nclanka.lk - Password:
OgNl@$200
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.nclanka.lk - Port:
587 - Username:
sales@nclanka.lk - Password:
OgNl@$200
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Executes dropped EXE 5 IoCs
Processes:
._cache_ad28e18735d8e13304ef1adcf4218cec.exeSynaptics.exeSynaptics.exeSynaptics.exe._cache_Synaptics.exepid process 2656 ._cache_ad28e18735d8e13304ef1adcf4218cec.exe 608 Synaptics.exe 2992 Synaptics.exe 1636 Synaptics.exe 1704 ._cache_Synaptics.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ad28e18735d8e13304ef1adcf4218cec.exeSynaptics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation ad28e18735d8e13304ef1adcf4218cec.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
._cache_ad28e18735d8e13304ef1adcf4218cec.exe._cache_Synaptics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_ad28e18735d8e13304ef1adcf4218cec.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_ad28e18735d8e13304ef1adcf4218cec.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_ad28e18735d8e13304ef1adcf4218cec.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ad28e18735d8e13304ef1adcf4218cec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" ad28e18735d8e13304ef1adcf4218cec.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 checkip.dyndns.org 30 freegeoip.app 31 freegeoip.app 36 checkip.dyndns.org 41 freegeoip.app -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ad28e18735d8e13304ef1adcf4218cec.exeSynaptics.exedescription pid process target process PID 2716 set thread context of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 608 set thread context of 1636 608 Synaptics.exe Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
ad28e18735d8e13304ef1adcf4218cec.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance ad28e18735d8e13304ef1adcf4218cec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Synaptics.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
._cache_ad28e18735d8e13304ef1adcf4218cec.exeSynaptics.exe._cache_Synaptics.exepid process 2656 ._cache_ad28e18735d8e13304ef1adcf4218cec.exe 608 Synaptics.exe 608 Synaptics.exe 1704 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
._cache_ad28e18735d8e13304ef1adcf4218cec.exeSynaptics.exe._cache_Synaptics.exedescription pid process Token: SeDebugPrivilege 2656 ._cache_ad28e18735d8e13304ef1adcf4218cec.exe Token: SeDebugPrivilege 608 Synaptics.exe Token: SeDebugPrivilege 1704 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
ad28e18735d8e13304ef1adcf4218cec.exead28e18735d8e13304ef1adcf4218cec.exeSynaptics.exeSynaptics.exedescription pid process target process PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 2716 wrote to memory of 3480 2716 ad28e18735d8e13304ef1adcf4218cec.exe ad28e18735d8e13304ef1adcf4218cec.exe PID 3480 wrote to memory of 2656 3480 ad28e18735d8e13304ef1adcf4218cec.exe ._cache_ad28e18735d8e13304ef1adcf4218cec.exe PID 3480 wrote to memory of 2656 3480 ad28e18735d8e13304ef1adcf4218cec.exe ._cache_ad28e18735d8e13304ef1adcf4218cec.exe PID 3480 wrote to memory of 2656 3480 ad28e18735d8e13304ef1adcf4218cec.exe ._cache_ad28e18735d8e13304ef1adcf4218cec.exe PID 3480 wrote to memory of 608 3480 ad28e18735d8e13304ef1adcf4218cec.exe Synaptics.exe PID 3480 wrote to memory of 608 3480 ad28e18735d8e13304ef1adcf4218cec.exe Synaptics.exe PID 3480 wrote to memory of 608 3480 ad28e18735d8e13304ef1adcf4218cec.exe Synaptics.exe PID 608 wrote to memory of 2992 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 2992 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 2992 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 608 wrote to memory of 1636 608 Synaptics.exe Synaptics.exe PID 1636 wrote to memory of 1704 1636 Synaptics.exe ._cache_Synaptics.exe PID 1636 wrote to memory of 1704 1636 Synaptics.exe ._cache_Synaptics.exe PID 1636 wrote to memory of 1704 1636 Synaptics.exe ._cache_Synaptics.exe -
outlook_office_path 1 IoCs
Processes:
._cache_Synaptics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe -
outlook_win_path 1 IoCs
Processes:
._cache_Synaptics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad28e18735d8e13304ef1adcf4218cec.exe"C:\Users\Admin\AppData\Local\Temp\ad28e18735d8e13304ef1adcf4218cec.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad28e18735d8e13304ef1adcf4218cec.exe"C:\Users\Admin\AppData\Local\Temp\ad28e18735d8e13304ef1adcf4218cec.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_ad28e18735d8e13304ef1adcf4218cec.exe"C:\Users\Admin\AppData\Local\Temp\._cache_ad28e18735d8e13304ef1adcf4218cec.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
ccf0c41143f04444dcab85db98db93c7
SHA19d637ed68aaece735be17656b2208e8338d49ab2
SHA2564ff94d4c0408578e888c3d1929e869324eaecc2e8ce2b9861ae7ed5ebb93b753
SHA5120027388742b2207f89aa3e12bc7d318c4ad2ab246e5e2db4438343303b6171e113e93c657f79f9e2fd41aac2acf791a42074d45f2209eb005238ad618369ef2b
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
ccf0c41143f04444dcab85db98db93c7
SHA19d637ed68aaece735be17656b2208e8338d49ab2
SHA2564ff94d4c0408578e888c3d1929e869324eaecc2e8ce2b9861ae7ed5ebb93b753
SHA5120027388742b2207f89aa3e12bc7d318c4ad2ab246e5e2db4438343303b6171e113e93c657f79f9e2fd41aac2acf791a42074d45f2209eb005238ad618369ef2b
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
ccf0c41143f04444dcab85db98db93c7
SHA19d637ed68aaece735be17656b2208e8338d49ab2
SHA2564ff94d4c0408578e888c3d1929e869324eaecc2e8ce2b9861ae7ed5ebb93b753
SHA5120027388742b2207f89aa3e12bc7d318c4ad2ab246e5e2db4438343303b6171e113e93c657f79f9e2fd41aac2acf791a42074d45f2209eb005238ad618369ef2b
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
ccf0c41143f04444dcab85db98db93c7
SHA19d637ed68aaece735be17656b2208e8338d49ab2
SHA2564ff94d4c0408578e888c3d1929e869324eaecc2e8ce2b9861ae7ed5ebb93b753
SHA5120027388742b2207f89aa3e12bc7d318c4ad2ab246e5e2db4438343303b6171e113e93c657f79f9e2fd41aac2acf791a42074d45f2209eb005238ad618369ef2b
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
C:\Users\Admin\AppData\Local\Temp\._cache_ad28e18735d8e13304ef1adcf4218cec.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
C:\Users\Admin\AppData\Local\Temp\._cache_ad28e18735d8e13304ef1adcf4218cec.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
memory/608-140-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/608-137-0x0000000000000000-mapping.dmp
-
memory/608-147-0x0000000004A50000-0x0000000004F4E000-memory.dmpFilesize
5.0MB
-
memory/1636-155-0x000000000049AB80-mapping.dmp
-
memory/1636-157-0x0000000000400000-0x00000000004E1000-memory.dmpFilesize
900KB
-
memory/1636-158-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/1704-159-0x0000000000000000-mapping.dmp
-
memory/1704-166-0x00000000048D0000-0x0000000004DCE000-memory.dmpFilesize
5.0MB
-
memory/2656-132-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/2656-148-0x0000000006870000-0x0000000006871000-memory.dmpFilesize
4KB
-
memory/2656-136-0x00000000054F0000-0x00000000054F1000-memory.dmpFilesize
4KB
-
memory/2656-129-0x0000000000000000-mapping.dmp
-
memory/2716-120-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/2716-124-0x000000000B230000-0x000000000B33F000-memory.dmpFilesize
1.1MB
-
memory/2716-123-0x00000000089C0000-0x0000000008AC5000-memory.dmpFilesize
1.0MB
-
memory/2716-122-0x00000000083E0000-0x00000000083E1000-memory.dmpFilesize
4KB
-
memory/2716-121-0x0000000005410000-0x0000000005426000-memory.dmpFilesize
88KB
-
memory/2716-115-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/2716-119-0x0000000004F70000-0x000000000546E000-memory.dmpFilesize
5.0MB
-
memory/2716-118-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/2716-117-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/3480-128-0x0000000001390000-0x0000000001391000-memory.dmpFilesize
4KB
-
memory/3480-126-0x000000000049AB80-mapping.dmp
-
memory/3480-127-0x0000000000400000-0x00000000004E1000-memory.dmpFilesize
900KB
-
memory/3480-125-0x0000000000400000-0x00000000004E1000-memory.dmpFilesize
900KB