Analysis
- max time kernel
119s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
03/01/2022, 12:20
General
- Target 60558110027ppt.exe
- Size 368KB
- Sample220103-phr8dshfhm
- SHA256 8b50c938229f25f79543d786b2dd7df127c1fa79ba0f8acea807741aea401310
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
octfirr.shop
-
Port
587
-
Username
-
Password
#^&uHH7b3HEyH{5HUs
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60558110027ppt.exe"C:\Users\Admin\AppData\Local\Temp\60558110027ppt.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc aQBwAGMAbwBuAGYAaQBnACAALwByAGUAbABlAGEAcwBlAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release3⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc aQBwAGMAbwBuAGYAaQBnACAALwByAGUAbgBlAHcA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew3⤵
- Gathers network information
-
-
-
C:\Users\Admin\AppData\Local\Temp\60558110027ppt.exeC:\Users\Admin\AppData\Local\Temp\60558110027ppt.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1860-178-0x00000000006C0000-0x00000000006C1000-memory.dmp
memory/1860-167-0x0000000006BF0000-0x0000000006C12000-memory.dmp
memory/1860-163-0x00000000006C0000-0x00000000006C1000-memory.dmp
memory/1860-164-0x00000000006C0000-0x00000000006C1000-memory.dmp
memory/1860-183-0x00000000009D3000-0x00000000009D4000-memory.dmp
memory/1860-184-0x00000000009D4000-0x00000000009D6000-memory.dmp
memory/1860-165-0x0000000000970000-0x00000000009A6000-memory.dmp
memory/1860-181-0x00000000006C0000-0x00000000006C1000-memory.dmp
memory/1860-166-0x0000000006D30000-0x0000000007358000-memory.dmp
memory/1860-169-0x0000000007620000-0x0000000007686000-memory.dmp
memory/1860-177-0x0000000007D30000-0x0000000007DA6000-memory.dmp
memory/1860-176-0x0000000007F60000-0x0000000007FAB000-memory.dmp
memory/1860-174-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/1860-175-0x00000000009D2000-0x00000000009D3000-memory.dmp
memory/1860-173-0x0000000007A00000-0x0000000007A1C000-memory.dmp
memory/1860-170-0x0000000007690000-0x00000000079E0000-memory.dmp
memory/1860-168-0x0000000006C90000-0x0000000006CF6000-memory.dmp
memory/2068-115-0x0000000000D00000-0x0000000000D62000-memory.dmp
memory/2068-182-0x0000000005680000-0x00000000056D8000-memory.dmp
memory/2068-185-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/2068-186-0x0000000001450000-0x00000000014E2000-memory.dmp
memory/2068-116-0x0000000000D00000-0x0000000000D62000-memory.dmp
memory/3016-143-0x00000000089F0000-0x0000000008A66000-memory.dmp
memory/3016-172-0x0000000007393000-0x0000000007394000-memory.dmp
memory/3016-147-0x0000000003470000-0x0000000003471000-memory.dmp
memory/3016-161-0x0000000003470000-0x0000000003471000-memory.dmp
memory/3016-126-0x0000000007390000-0x0000000007391000-memory.dmp
memory/3016-129-0x00000000079D0000-0x0000000007FF8000-memory.dmp
memory/3016-131-0x0000000007840000-0x0000000007862000-memory.dmp
memory/3016-157-0x000000000A1B0000-0x000000000A828000-memory.dmp
memory/3016-158-0x00000000097F0000-0x000000000980A000-memory.dmp
memory/3016-124-0x0000000004EC0000-0x0000000004EF6000-memory.dmp
memory/3016-133-0x0000000008070000-0x00000000080D6000-memory.dmp
memory/3016-119-0x0000000003470000-0x0000000003471000-memory.dmp
memory/3016-134-0x0000000008330000-0x0000000008396000-memory.dmp
memory/3016-142-0x0000000008C00000-0x0000000008C4B000-memory.dmp
memory/3016-128-0x0000000007392000-0x0000000007393000-memory.dmp
memory/3016-140-0x0000000008100000-0x000000000811C000-memory.dmp
memory/3016-138-0x00000000083A0000-0x00000000086F0000-memory.dmp
memory/3016-122-0x0000000003470000-0x0000000003471000-memory.dmp
memory/3140-187-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3140-191-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3140-190-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3140-192-0x0000000005C90000-0x000000000618E000-memory.dmp
memory/3140-193-0x00000000056A0000-0x000000000573C000-memory.dmp
memory/3140-194-0x0000000005600000-0x000000000569C000-memory.dmp
memory/3140-195-0x0000000006790000-0x0000000006952000-memory.dmp
memory/3140-196-0x0000000006670000-0x0000000006702000-memory.dmp
memory/3140-197-0x0000000006630000-0x000000000663A000-memory.dmp
memory/3244-120-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/3244-130-0x0000000007300000-0x0000000007928000-memory.dmp
memory/3244-125-0x0000000006CC0000-0x0000000006CC1000-memory.dmp
memory/3244-132-0x0000000007270000-0x0000000007292000-memory.dmp
memory/3244-123-0x0000000006C20000-0x0000000006C56000-memory.dmp
memory/3244-121-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/3244-135-0x00000000079A0000-0x0000000007A06000-memory.dmp
memory/3244-136-0x0000000007B10000-0x0000000007B76000-memory.dmp
memory/3244-137-0x0000000007C20000-0x0000000007F70000-memory.dmp
memory/3244-139-0x0000000007BA0000-0x0000000007BBC000-memory.dmp
memory/3244-141-0x0000000008040000-0x000000000808B000-memory.dmp
memory/3244-145-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/3244-144-0x0000000008360000-0x00000000083D6000-memory.dmp
memory/3244-127-0x0000000006CC2000-0x0000000006CC3000-memory.dmp
memory/3244-153-0x0000000006CC3000-0x0000000006CC4000-memory.dmp
memory/3244-154-0x0000000006CC4000-0x0000000006CC6000-memory.dmp
memory/3244-152-0x0000000002B90000-0x0000000002B91000-memory.dmp