Analysis
- max time kernel
154s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/01/2022, 08:13
General
- Target DHL AWB#68625.pdf.exe
- Size 351KB
- Sample220120-j4e73ahaa7
- SHA256 f2a224c514f49ca2f17c6aee38fdf8d61516ff9f68dd3d335b3e5850c6b5a8e1
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.crestftb.com
-
Port
587
-
Username
-
Password
BRIAN22@1234567891011
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 1 IoCs
- Sets service image path in registry 2 TTPs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB#68625.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB#68625.pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gnDmrTolNrlPEc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gnDmrTolNrlPEc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp284.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB#68625.pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB#68625.pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe de7ffb62fc6331e186bc7c05066fdb9d J8wrm8B0akOEgPouubXOBA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3028-319-0x0000000006C70000-0x0000000006E32000-memory.dmp
memory/3028-317-0x0000000005580000-0x0000000005B24000-memory.dmp
memory/3028-311-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3508-130-0x00000000004A0000-0x00000000004FC000-memory.dmp
memory/3508-131-0x00000000054D0000-0x0000000005A74000-memory.dmp
memory/3508-132-0x0000000004F20000-0x0000000004FB2000-memory.dmp
memory/3508-133-0x0000000004F20000-0x00000000054C4000-memory.dmp
memory/3508-134-0x0000000004EA0000-0x0000000004EAA000-memory.dmp
memory/3508-305-0x0000000007360000-0x00000000073FC000-memory.dmp
memory/4056-316-0x0000000007690000-0x00000000076F6000-memory.dmp
memory/4056-321-0x0000000008A10000-0x0000000008A42000-memory.dmp
memory/4056-314-0x0000000007380000-0x00000000073A2000-memory.dmp
memory/4056-315-0x0000000007620000-0x0000000007686000-memory.dmp
memory/4056-312-0x00000000071E0000-0x00000000071E1000-memory.dmp
memory/4056-310-0x0000000007820000-0x0000000007E48000-memory.dmp
memory/4056-318-0x0000000007210000-0x000000000722E000-memory.dmp
memory/4056-308-0x0000000004B30000-0x0000000004B66000-memory.dmp
memory/4056-320-0x00000000071E5000-0x00000000071E7000-memory.dmp
memory/4056-313-0x00000000071E2000-0x00000000071E3000-memory.dmp
memory/4056-322-0x00000000708F0000-0x000000007093C000-memory.dmp
memory/4056-323-0x00000000089F0000-0x0000000008A0E000-memory.dmp
memory/4056-324-0x000000007F1A0000-0x000000007F1A1000-memory.dmp
memory/4056-325-0x0000000009E10000-0x000000000A48A000-memory.dmp
memory/4056-326-0x00000000097D0000-0x00000000097EA000-memory.dmp
memory/4056-327-0x0000000009850000-0x000000000985A000-memory.dmp
memory/4056-328-0x0000000009A50000-0x0000000009AE6000-memory.dmp
memory/4056-329-0x0000000009A00000-0x0000000009A0E000-memory.dmp
memory/4056-330-0x0000000009B10000-0x0000000009B2A000-memory.dmp
memory/4056-331-0x0000000009AF0000-0x0000000009AF8000-memory.dmp