Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
05-12-2021 07:27
Static task
static1
Behavioral task
behavioral1
Sample
a72f3d7698f6126013cff4e4ad1fb808.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a72f3d7698f6126013cff4e4ad1fb808.exe
Resource
win10-en-20211014
General
-
Target
a72f3d7698f6126013cff4e4ad1fb808.exe
-
Size
1.7MB
-
MD5
a72f3d7698f6126013cff4e4ad1fb808
-
SHA1
cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb
-
SHA256
71ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c
-
SHA512
1c23c290cc4ce5876a7f86677da352e9229c387f03ef504a6287978001bb228b85aea46eb4493f886a1602691fa2b85cca3addf5c487a303ac590ab454db501b
Malware Config
Extracted
Protocol: smtp- Host:
mail.nclanka.lk - Port:
587 - Username:
sales@nclanka.lk - Password:
OgNl@$200
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.nclanka.lk - Port:
587 - Username:
sales@nclanka.lk - Password:
OgNl@$200
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Executes dropped EXE 4 IoCs
Processes:
._cache_a72f3d7698f6126013cff4e4ad1fb808.exeSynaptics.exeSynaptics.exe._cache_Synaptics.exepid process 1828 ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe 396 Synaptics.exe 1652 Synaptics.exe 3868 ._cache_Synaptics.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exeSynaptics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation a72f3d7698f6126013cff4e4ad1fb808.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Synaptics.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
._cache_a72f3d7698f6126013cff4e4ad1fb808.exe._cache_Synaptics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" a72f3d7698f6126013cff4e4ad1fb808.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 freegeoip.app 32 freegeoip.app 35 checkip.dyndns.org 37 freegeoip.app 28 checkip.dyndns.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exeSynaptics.exedescription pid process target process PID 2816 set thread context of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 396 set thread context of 1652 396 Synaptics.exe Synaptics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exeSynaptics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance a72f3d7698f6126013cff4e4ad1fb808.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Synaptics.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exe._cache_a72f3d7698f6126013cff4e4ad1fb808.exe._cache_Synaptics.exepid process 2816 a72f3d7698f6126013cff4e4ad1fb808.exe 2816 a72f3d7698f6126013cff4e4ad1fb808.exe 1828 ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe 3868 ._cache_Synaptics.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exe._cache_a72f3d7698f6126013cff4e4ad1fb808.exe._cache_Synaptics.exedescription pid process Token: SeDebugPrivilege 2816 a72f3d7698f6126013cff4e4ad1fb808.exe Token: SeDebugPrivilege 1828 ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe Token: SeDebugPrivilege 3868 ._cache_Synaptics.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
a72f3d7698f6126013cff4e4ad1fb808.exea72f3d7698f6126013cff4e4ad1fb808.exeSynaptics.exeSynaptics.exedescription pid process target process PID 2816 wrote to memory of 4068 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 4068 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 4068 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 2816 wrote to memory of 3880 2816 a72f3d7698f6126013cff4e4ad1fb808.exe a72f3d7698f6126013cff4e4ad1fb808.exe PID 3880 wrote to memory of 1828 3880 a72f3d7698f6126013cff4e4ad1fb808.exe ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe PID 3880 wrote to memory of 1828 3880 a72f3d7698f6126013cff4e4ad1fb808.exe ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe PID 3880 wrote to memory of 1828 3880 a72f3d7698f6126013cff4e4ad1fb808.exe ._cache_a72f3d7698f6126013cff4e4ad1fb808.exe PID 3880 wrote to memory of 396 3880 a72f3d7698f6126013cff4e4ad1fb808.exe Synaptics.exe PID 3880 wrote to memory of 396 3880 a72f3d7698f6126013cff4e4ad1fb808.exe Synaptics.exe PID 3880 wrote to memory of 396 3880 a72f3d7698f6126013cff4e4ad1fb808.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 396 wrote to memory of 1652 396 Synaptics.exe Synaptics.exe PID 1652 wrote to memory of 3868 1652 Synaptics.exe ._cache_Synaptics.exe PID 1652 wrote to memory of 3868 1652 Synaptics.exe ._cache_Synaptics.exe PID 1652 wrote to memory of 3868 1652 Synaptics.exe ._cache_Synaptics.exe -
outlook_office_path 1 IoCs
Processes:
._cache_Synaptics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe -
outlook_win_path 1 IoCs
Processes:
._cache_Synaptics.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ._cache_Synaptics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a72f3d7698f6126013cff4e4ad1fb808.exe"C:\Users\Admin\AppData\Local\Temp\a72f3d7698f6126013cff4e4ad1fb808.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a72f3d7698f6126013cff4e4ad1fb808.exe"C:\Users\Admin\AppData\Local\Temp\a72f3d7698f6126013cff4e4ad1fb808.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a72f3d7698f6126013cff4e4ad1fb808.exe"C:\Users\Admin\AppData\Local\Temp\a72f3d7698f6126013cff4e4ad1fb808.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_a72f3d7698f6126013cff4e4ad1fb808.exe"C:\Users\Admin\AppData\Local\Temp\._cache_a72f3d7698f6126013cff4e4ad1fb808.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
a72f3d7698f6126013cff4e4ad1fb808
SHA1cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb
SHA25671ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c
SHA5121c23c290cc4ce5876a7f86677da352e9229c387f03ef504a6287978001bb228b85aea46eb4493f886a1602691fa2b85cca3addf5c487a303ac590ab454db501b
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
a72f3d7698f6126013cff4e4ad1fb808
SHA1cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb
SHA25671ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c
SHA5121c23c290cc4ce5876a7f86677da352e9229c387f03ef504a6287978001bb228b85aea46eb4493f886a1602691fa2b85cca3addf5c487a303ac590ab454db501b
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
a72f3d7698f6126013cff4e4ad1fb808
SHA1cd44ae59eb8ae4111c53e8b4a3da5e7ba1af48bb
SHA25671ae3e49cd3e22ac2de6cc53dd6b662d8f65d8f4d9f4e882e1b88d3cff18e18c
SHA5121c23c290cc4ce5876a7f86677da352e9229c387f03ef504a6287978001bb228b85aea46eb4493f886a1602691fa2b85cca3addf5c487a303ac590ab454db501b
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
C:\Users\Admin\AppData\Local\Temp\._cache_a72f3d7698f6126013cff4e4ad1fb808.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
C:\Users\Admin\AppData\Local\Temp\._cache_a72f3d7698f6126013cff4e4ad1fb808.exeMD5
ba9fe00d326f5997104101d59460e994
SHA146acc8f6c5f441f594d38e7062d63abfd2286807
SHA2566e9e6f46101684f027120ad7ad467587899924d49387c7feab1f792342575e4b
SHA51269009b4b6adbfa6e4eb5ed21486ab78ab706b8a6ba02628319df5c4ac6913e495655bdd552ac4fc4dc5cd7ac6bccb73b86e0f531badfe43f65acde466323687d
-
memory/396-147-0x0000000005150000-0x000000000564E000-memory.dmpFilesize
5.0MB
-
memory/396-136-0x0000000000000000-mapping.dmp
-
memory/1652-157-0x00000000013D0000-0x00000000013D1000-memory.dmpFilesize
4KB
-
memory/1652-156-0x0000000000400000-0x00000000004E1000-memory.dmpFilesize
900KB
-
memory/1652-154-0x000000000049AB80-mapping.dmp
-
memory/1828-129-0x0000000000000000-mapping.dmp
-
memory/1828-148-0x00000000065D0000-0x00000000065D1000-memory.dmpFilesize
4KB
-
memory/1828-146-0x0000000005200000-0x00000000056FE000-memory.dmpFilesize
5.0MB
-
memory/1828-132-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/2816-122-0x00000000086A0000-0x00000000086A1000-memory.dmpFilesize
4KB
-
memory/2816-124-0x000000000B500000-0x000000000B60F000-memory.dmpFilesize
1.1MB
-
memory/2816-121-0x00000000055D0000-0x00000000055E6000-memory.dmpFilesize
88KB
-
memory/2816-120-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/2816-123-0x0000000008C80000-0x0000000008D85000-memory.dmpFilesize
1.0MB
-
memory/2816-115-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/2816-119-0x0000000004FE0000-0x0000000005072000-memory.dmpFilesize
584KB
-
memory/2816-117-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/2816-118-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/3868-158-0x0000000000000000-mapping.dmp
-
memory/3868-165-0x00000000050F0000-0x00000000055EE000-memory.dmpFilesize
5.0MB
-
memory/3880-127-0x0000000000400000-0x00000000004E1000-memory.dmpFilesize
900KB
-
memory/3880-125-0x0000000000400000-0x00000000004E1000-memory.dmpFilesize
900KB
-
memory/3880-126-0x000000000049AB80-mapping.dmp
-
memory/3880-128-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB