Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
14/03/2022, 08:25
General
- Target 879f554dac5e64418d38df7ca87f6dfb.exe
- Size 58KB
- Sample220314-kbamjsfggj
- SHA256 7ca44e6eee2fd56c406711959a6a9a2e8804b4cdd7f929263dd5b0ce62f2a5ec
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot5134505060:AAEM06dt6eRhSMYn4UqGXyrLc66SKfCD5-I/sendMessage?chat_id=5034680713
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\879f554dac5e64418d38df7ca87f6dfb.exe"C:\Users\Admin\AppData\Local\Temp\879f554dac5e64418d38df7ca87f6dfb.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 14443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2952 -ip 29521⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2952-137-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2952-139-0x0000000075060000-0x0000000075810000-memory.dmp
memory/2952-138-0x00000000054A0000-0x000000000553C000-memory.dmp
memory/2952-140-0x00000000054A0000-0x0000000005A44000-memory.dmp
memory/4196-130-0x0000000000250000-0x0000000000264000-memory.dmp
memory/4196-131-0x0000000075060000-0x0000000075810000-memory.dmp
memory/4196-132-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/4196-133-0x000000000BB00000-0x000000000BB50000-memory.dmp
memory/4196-134-0x000000000BC10000-0x000000000BCC2000-memory.dmp
memory/4196-135-0x000000000C280000-0x000000000C824000-memory.dmp
memory/4196-136-0x000000000BD70000-0x000000000BE02000-memory.dmp