Analysis
-
max time kernel
4294180s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
25-03-2022 17:17
Static task
static1
Behavioral task
behavioral1
Sample
Jvhmoaft.exe
Resource
win7-20220311-en
General
-
Target
Jvhmoaft.exe
-
Size
39KB
-
MD5
f9042a40439be42c2cfa8c383d87187c
-
SHA1
1f86fbb29ae56ed28b158205976dfe9d51f8ff17
-
SHA256
de548a7533d3aa11d7a2206cc903d09d4475fdb6f1e33f3c567573600e691574
-
SHA512
f045c94a6258bbf97ec0e1ff11fffad8dd169c575c87310241f264a56765a0732a4d8fd5c869a629b58f4a7f4184e11c03ce590281a08fee9494fb0e6c050cf3
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5171883538:AAEyFWuNh68SJNNpkDCQbviRgrklZA3K4Qs/sendMessage?chat_id=1376739206
Extracted
xloader
2.5
ssac
beautybybrin.com
oregemo.com
prospectoriq.com
blazermid.com
cloudnineloans.com
myyntisofta.com
filoupoils.com
web-solutiontnpasumo3.xyz
becbares.com
lines-hikkoshi.com
ohayouwww.com
writingdadsobituarywithdad.com
bridalbaes.com
jamshir.com
rangertots.com
dankbrobeans.com
titan111.com
uplearns.info
maxicashprokil.xyz
evc24.com
mingshan888.com
thehomefurnishings.com
jjyive.space
vtkk.info
state-attorney.online
zoho.systems
nd300.com
ivermectinforanimals.ca
gruppobenedetto.com
planet99angka.xyz
astrotiq.com
fangshensj.com
ocean.limited
zalaridumpf.quest
cursolibreonline.com
lifein.art
identspactures.com
nfltvgo.com
chronicfit.store
mariajosereina.com
hebbz764776341.com
anpxlmmspix.mobi
mydevhub.tech
nobelrealm.com
dentalteamny.com
patinerd.com
socratisbey.xyz
hnylcwfs.com
yujieqin.com
midorato.com
sunglowdragon.com
americaplr.com
cxqdscape.com
situsgacor.xyz
sattlerei-dortmund.com
life120lospaccio.com
riddleme.one
perpustakaan-geominerba.online
renatafaceandbodyskincare.com
allkoreas.com
myvisitiq.com
candlesallday.com
poleador.com
4hsp116.com
homesbyvw.com
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 10 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe family_snakekeylogger \Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe family_snakekeylogger \Users\Admin\AppData\Local\Temp\20snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe family_snakekeylogger \Users\Admin\AppData\Local\Temp\40snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe family_snakekeylogger behavioral1/memory/2008-88-0x0000000000050000-0x0000000000076000-memory.dmp family_snakekeylogger -
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1224-76-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1224-77-0x000000000041D3B0-mapping.dmp xloader -
Executes dropped EXE 3 IoCs
Processes:
Ouzrnaxufxjssnkcombined.exe20snkprotect.exe40snkprotect.exepid process 1668 Ouzrnaxufxjssnkcombined.exe 1128 20snkprotect.exe 2008 40snkprotect.exe -
Loads dropped DLL 4 IoCs
Processes:
Jvhmoaft.exeOuzrnaxufxjssnkcombined.exepid process 1768 Jvhmoaft.exe 1768 Jvhmoaft.exe 1668 Ouzrnaxufxjssnkcombined.exe 1668 Ouzrnaxufxjssnkcombined.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
Processes:
40snkprotect.exe20snkprotect.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 40snkprotect.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 20snkprotect.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 20snkprotect.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 20snkprotect.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 40snkprotect.exe Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 40snkprotect.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 checkip.dyndns.org 20 freegeoip.app 21 freegeoip.app 23 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Jvhmoaft.exedescription pid process target process PID 1768 set thread context of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 284 1224 WerFault.exe Jvhmoaft.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1972 timeout.exe -
Processes:
20snkprotect.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 20snkprotect.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 20snkprotect.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d461d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67080b00000001000000140000005500530045005200540072007500730074000000140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8090000000100000016000000301406082b0601050507030306082b060105050703080f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 20snkprotect.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d80b000000010000001400000055005300450052005400720075007300740000001d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 20snkprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 20snkprotect.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 20snkprotect.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb57485053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 20snkprotect.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 20snkprotect.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeJvhmoaft.exe40snkprotect.exe20snkprotect.exepid process 1076 powershell.exe 1768 Jvhmoaft.exe 1768 Jvhmoaft.exe 2008 40snkprotect.exe 1128 20snkprotect.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Jvhmoaft.exepowershell.exe40snkprotect.exe20snkprotect.exedescription pid process Token: SeDebugPrivilege 1768 Jvhmoaft.exe Token: SeDebugPrivilege 1076 powershell.exe Token: SeDebugPrivilege 2008 40snkprotect.exe Token: SeDebugPrivilege 1128 20snkprotect.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
Ouzrnaxufxjssnkcombined.exe20snkprotect.exe40snkprotect.exepid process 1668 Ouzrnaxufxjssnkcombined.exe 1128 20snkprotect.exe 2008 40snkprotect.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
Jvhmoaft.execmd.exeJvhmoaft.exeOuzrnaxufxjssnkcombined.exe20snkprotect.exe40snkprotect.exedescription pid process target process PID 1768 wrote to memory of 1076 1768 Jvhmoaft.exe powershell.exe PID 1768 wrote to memory of 1076 1768 Jvhmoaft.exe powershell.exe PID 1768 wrote to memory of 1076 1768 Jvhmoaft.exe powershell.exe PID 1768 wrote to memory of 1076 1768 Jvhmoaft.exe powershell.exe PID 1768 wrote to memory of 272 1768 Jvhmoaft.exe cmd.exe PID 1768 wrote to memory of 272 1768 Jvhmoaft.exe cmd.exe PID 1768 wrote to memory of 272 1768 Jvhmoaft.exe cmd.exe PID 1768 wrote to memory of 272 1768 Jvhmoaft.exe cmd.exe PID 272 wrote to memory of 1972 272 cmd.exe timeout.exe PID 272 wrote to memory of 1972 272 cmd.exe timeout.exe PID 272 wrote to memory of 1972 272 cmd.exe timeout.exe PID 272 wrote to memory of 1972 272 cmd.exe timeout.exe PID 1768 wrote to memory of 1668 1768 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 1768 wrote to memory of 1668 1768 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 1768 wrote to memory of 1668 1768 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 1768 wrote to memory of 1668 1768 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1768 wrote to memory of 1224 1768 Jvhmoaft.exe Jvhmoaft.exe PID 1224 wrote to memory of 284 1224 Jvhmoaft.exe WerFault.exe PID 1224 wrote to memory of 284 1224 Jvhmoaft.exe WerFault.exe PID 1224 wrote to memory of 284 1224 Jvhmoaft.exe WerFault.exe PID 1224 wrote to memory of 284 1224 Jvhmoaft.exe WerFault.exe PID 1668 wrote to memory of 1128 1668 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 1668 wrote to memory of 1128 1668 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 1668 wrote to memory of 1128 1668 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 1668 wrote to memory of 1128 1668 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 1668 wrote to memory of 2008 1668 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 1668 wrote to memory of 2008 1668 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 1668 wrote to memory of 2008 1668 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 1668 wrote to memory of 2008 1668 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 1128 wrote to memory of 560 1128 20snkprotect.exe netsh.exe PID 1128 wrote to memory of 560 1128 20snkprotect.exe netsh.exe PID 1128 wrote to memory of 560 1128 20snkprotect.exe netsh.exe PID 1128 wrote to memory of 560 1128 20snkprotect.exe netsh.exe PID 2008 wrote to memory of 572 2008 40snkprotect.exe netsh.exe PID 2008 wrote to memory of 572 2008 40snkprotect.exe netsh.exe PID 2008 wrote to memory of 572 2008 40snkprotect.exe netsh.exe PID 2008 wrote to memory of 572 2008 40snkprotect.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
40snkprotect.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 40snkprotect.exe -
outlook_win_path 1 IoCs
Processes:
40snkprotect.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 40snkprotect.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe"C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA2AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 352⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 353⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe"C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe"C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe" 03⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile4⤵
-
C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe"C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe" 03⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile4⤵
-
C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exeC:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 363⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\20snkprotect.exeMD5
1b5cdaae707008b8060676c238623313
SHA19c43145e129634d31e0f664a9c3f467ba235ce6c
SHA2566c39d7763e7bb0df8a0ad0ab1ebd0252b53499d45900b6df2987020429206edd
SHA512471fec457640fd594bcdd39647293ac9fff5911dcfb5f795141e82c796109aa34d468d42707f5079bafefd2a0b1567130a78e553f65fb29f96cd686688e12de1
-
C:\Users\Admin\AppData\Local\Temp\20snkprotect.exeMD5
1b5cdaae707008b8060676c238623313
SHA19c43145e129634d31e0f664a9c3f467ba235ce6c
SHA2566c39d7763e7bb0df8a0ad0ab1ebd0252b53499d45900b6df2987020429206edd
SHA512471fec457640fd594bcdd39647293ac9fff5911dcfb5f795141e82c796109aa34d468d42707f5079bafefd2a0b1567130a78e553f65fb29f96cd686688e12de1
-
C:\Users\Admin\AppData\Local\Temp\40snkprotect.exeMD5
aa7372ee69da4eca16f92ee98bf53a7b
SHA1e76529db49cba47cb2a32d4dd64472fcf72f0a11
SHA256871a0b2fa5664bd5ed819edb7c037b81b2b552e4ab9eec6f87adbf32d51365ef
SHA5125444e8ea89257504ef62ce6e2c7481fdcb8a64fb87f3dbc0e64130ad39bee45cfe075d8511ba93ad49c098d3f8d2a821226709421d3c341157441fef7b003151
-
C:\Users\Admin\AppData\Local\Temp\40snkprotect.exeMD5
aa7372ee69da4eca16f92ee98bf53a7b
SHA1e76529db49cba47cb2a32d4dd64472fcf72f0a11
SHA256871a0b2fa5664bd5ed819edb7c037b81b2b552e4ab9eec6f87adbf32d51365ef
SHA5125444e8ea89257504ef62ce6e2c7481fdcb8a64fb87f3dbc0e64130ad39bee45cfe075d8511ba93ad49c098d3f8d2a821226709421d3c341157441fef7b003151
-
C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exeMD5
87ff3063dc995f8b0d49237caf49996a
SHA17feada75d9c02dac44c97cd913633ec12b1ceef6
SHA256645bc6053b810ba900a1ad4955d90b0a9f3d1d46caf3bf3523df10a940752050
SHA512ec55ebda6e741f596ddae8d19601f7eabee2afda9b448d66df603e39dcaf51801fec7f7efe29200c46eb5aa9d98db1ae0ab619e4f115b8d428c32823eed89a3c
-
\Users\Admin\AppData\Local\Temp\20snkprotect.exeMD5
1b5cdaae707008b8060676c238623313
SHA19c43145e129634d31e0f664a9c3f467ba235ce6c
SHA2566c39d7763e7bb0df8a0ad0ab1ebd0252b53499d45900b6df2987020429206edd
SHA512471fec457640fd594bcdd39647293ac9fff5911dcfb5f795141e82c796109aa34d468d42707f5079bafefd2a0b1567130a78e553f65fb29f96cd686688e12de1
-
\Users\Admin\AppData\Local\Temp\40snkprotect.exeMD5
aa7372ee69da4eca16f92ee98bf53a7b
SHA1e76529db49cba47cb2a32d4dd64472fcf72f0a11
SHA256871a0b2fa5664bd5ed819edb7c037b81b2b552e4ab9eec6f87adbf32d51365ef
SHA5125444e8ea89257504ef62ce6e2c7481fdcb8a64fb87f3dbc0e64130ad39bee45cfe075d8511ba93ad49c098d3f8d2a821226709421d3c341157441fef7b003151
-
\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exeMD5
87ff3063dc995f8b0d49237caf49996a
SHA17feada75d9c02dac44c97cd913633ec12b1ceef6
SHA256645bc6053b810ba900a1ad4955d90b0a9f3d1d46caf3bf3523df10a940752050
SHA512ec55ebda6e741f596ddae8d19601f7eabee2afda9b448d66df603e39dcaf51801fec7f7efe29200c46eb5aa9d98db1ae0ab619e4f115b8d428c32823eed89a3c
-
\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exeMD5
87ff3063dc995f8b0d49237caf49996a
SHA17feada75d9c02dac44c97cd913633ec12b1ceef6
SHA256645bc6053b810ba900a1ad4955d90b0a9f3d1d46caf3bf3523df10a940752050
SHA512ec55ebda6e741f596ddae8d19601f7eabee2afda9b448d66df603e39dcaf51801fec7f7efe29200c46eb5aa9d98db1ae0ab619e4f115b8d428c32823eed89a3c
-
memory/272-64-0x0000000000000000-mapping.dmp
-
memory/284-78-0x0000000000000000-mapping.dmp
-
memory/560-90-0x0000000000000000-mapping.dmp
-
memory/572-92-0x0000000000000000-mapping.dmp
-
memory/1076-59-0x0000000002482000-0x0000000002484000-memory.dmpFilesize
8KB
-
memory/1076-58-0x0000000070A40000-0x0000000070FEB000-memory.dmpFilesize
5.7MB
-
memory/1076-56-0x0000000000000000-mapping.dmp
-
memory/1128-80-0x0000000000000000-mapping.dmp
-
memory/1128-89-0x0000000073CE0000-0x000000007428B000-memory.dmpFilesize
5.7MB
-
memory/1224-73-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1224-76-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1224-71-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1224-77-0x000000000041D3B0-mapping.dmp
-
memory/1668-68-0x0000000000000000-mapping.dmp
-
memory/1768-61-0x0000000000880000-0x00000000008CC000-memory.dmpFilesize
304KB
-
memory/1768-55-0x0000000076AC1000-0x0000000076AC3000-memory.dmpFilesize
8KB
-
memory/1768-54-0x00000000011F0000-0x0000000001200000-memory.dmpFilesize
64KB
-
memory/1768-63-0x0000000004F60000-0x0000000004FAC000-memory.dmpFilesize
304KB
-
memory/1768-62-0x0000000001150000-0x0000000001198000-memory.dmpFilesize
288KB
-
memory/1768-60-0x0000000005D70000-0x0000000005E84000-memory.dmpFilesize
1.1MB
-
memory/1972-65-0x0000000000000000-mapping.dmp
-
memory/2008-88-0x0000000000050000-0x0000000000076000-memory.dmpFilesize
152KB
-
memory/2008-84-0x0000000000000000-mapping.dmp