Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
07-12-2021 10:48
Static task
static1
Behavioral task
behavioral1
Sample
6430cb23ebe6fd38dd12dd0a579e9e3b.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
6430cb23ebe6fd38dd12dd0a579e9e3b.exe
Resource
win10-en-20211104
General
-
Target
6430cb23ebe6fd38dd12dd0a579e9e3b.exe
-
Size
372KB
-
MD5
6430cb23ebe6fd38dd12dd0a579e9e3b
-
SHA1
0564f13201c8d65ab64842742c761b5bc912b832
-
SHA256
5405e311e63cb69c69bc2eba909547fca4d91a60e998bcc825c1031cd148f816
-
SHA512
3e3e6b1b3096961a1b5081204cff23dcd1968fbb7cd5a9cd8dd0859cb1574cfe2581678f62edf4f54f95b481a51513c06255d7adb5c60f263df588fc68b41eac
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.metalkerhungaria.eu - Port:
587 - Username:
srun@metalkerhungaria.eu - Password:
wQYQDPh9
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6430cb23ebe6fd38dd12dd0a579e9e3b.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6430cb23ebe6fd38dd12dd0a579e9e3b.exe Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6430cb23ebe6fd38dd12dd0a579e9e3b.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 checkip.dyndns.org 25 freegeoip.app 26 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exedescription pid process target process PID 4348 set thread context of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exe6430cb23ebe6fd38dd12dd0a579e9e3b.exepid process 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 3084 6430cb23ebe6fd38dd12dd0a579e9e3b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exe6430cb23ebe6fd38dd12dd0a579e9e3b.exedescription pid process Token: SeDebugPrivilege 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe Token: SeDebugPrivilege 3084 6430cb23ebe6fd38dd12dd0a579e9e3b.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exedescription pid process target process PID 4348 wrote to memory of 4712 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 4712 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 4712 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 2856 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 2856 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 2856 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 4416 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 4416 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 4416 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe PID 4348 wrote to memory of 3084 4348 6430cb23ebe6fd38dd12dd0a579e9e3b.exe 6430cb23ebe6fd38dd12dd0a579e9e3b.exe -
outlook_office_path 1 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6430cb23ebe6fd38dd12dd0a579e9e3b.exe -
outlook_win_path 1 IoCs
Processes:
6430cb23ebe6fd38dd12dd0a579e9e3b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 6430cb23ebe6fd38dd12dd0a579e9e3b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"C:\Users\Admin\AppData\Local\Temp\6430cb23ebe6fd38dd12dd0a579e9e3b.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6430cb23ebe6fd38dd12dd0a579e9e3b.exe.logMD5
f1181bc4bdff57024c4121f645548332
SHA1d431ee3a3a5afcae2c4537b1d445054a0a95f6e6
SHA256f1a7e138b25d0cb24bb4b23bd781b0dd357afd49d45e19ffa44cdb80170336ad
SHA512cf8059f289bcb4f33e82a2c4851fade486bd449793a39718d49bc357efd09689150aedd277c5ebcf79b5ebb4bbe36f0cbb72510a50398bee804ffd9c889604e3
-
memory/3084-128-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/3084-136-0x00000000055A0000-0x0000000005A9E000-memory.dmpFilesize
5.0MB
-
memory/3084-135-0x0000000006870000-0x0000000006871000-memory.dmpFilesize
4KB
-
memory/3084-129-0x000000000041F85E-mapping.dmp
-
memory/4348-122-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/4348-125-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/4348-126-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/4348-127-0x0000000005790000-0x00000000057D9000-memory.dmpFilesize
292KB
-
memory/4348-124-0x0000000004B30000-0x0000000004B38000-memory.dmpFilesize
32KB
-
memory/4348-123-0x0000000004AC0000-0x0000000004FBE000-memory.dmpFilesize
5.0MB
-
memory/4348-118-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/4348-121-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/4348-120-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB