Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
25-03-2022 17:17
Static task
static1
Behavioral task
behavioral1
Sample
Jvhmoaft.exe
Resource
win7-20220311-en
General
-
Target
Jvhmoaft.exe
-
Size
39KB
-
MD5
f9042a40439be42c2cfa8c383d87187c
-
SHA1
1f86fbb29ae56ed28b158205976dfe9d51f8ff17
-
SHA256
de548a7533d3aa11d7a2206cc903d09d4475fdb6f1e33f3c567573600e691574
-
SHA512
f045c94a6258bbf97ec0e1ff11fffad8dd169c575c87310241f264a56765a0732a4d8fd5c869a629b58f4a7f4184e11c03ce590281a08fee9494fb0e6c050cf3
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5171883538:AAEyFWuNh68SJNNpkDCQbviRgrklZA3K4Qs/sendMessage?chat_id=1376739206
Extracted
xloader
2.5
ssac
beautybybrin.com
oregemo.com
prospectoriq.com
blazermid.com
cloudnineloans.com
myyntisofta.com
filoupoils.com
web-solutiontnpasumo3.xyz
becbares.com
lines-hikkoshi.com
ohayouwww.com
writingdadsobituarywithdad.com
bridalbaes.com
jamshir.com
rangertots.com
dankbrobeans.com
titan111.com
uplearns.info
maxicashprokil.xyz
evc24.com
mingshan888.com
thehomefurnishings.com
jjyive.space
vtkk.info
state-attorney.online
zoho.systems
nd300.com
ivermectinforanimals.ca
gruppobenedetto.com
planet99angka.xyz
astrotiq.com
fangshensj.com
ocean.limited
zalaridumpf.quest
cursolibreonline.com
lifein.art
identspactures.com
nfltvgo.com
chronicfit.store
mariajosereina.com
hebbz764776341.com
anpxlmmspix.mobi
mydevhub.tech
nobelrealm.com
dentalteamny.com
patinerd.com
socratisbey.xyz
hnylcwfs.com
yujieqin.com
midorato.com
sunglowdragon.com
americaplr.com
cxqdscape.com
situsgacor.xyz
sattlerei-dortmund.com
life120lospaccio.com
riddleme.one
perpustakaan-geominerba.online
renatafaceandbodyskincare.com
allkoreas.com
myvisitiq.com
candlesallday.com
poleador.com
4hsp116.com
homesbyvw.com
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe family_snakekeylogger C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe family_snakekeylogger behavioral2/memory/3768-157-0x00000000003F0000-0x0000000000416000-memory.dmp family_snakekeylogger -
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3880-148-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3880-161-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/5060-168-0x0000000000880000-0x00000000008A9000-memory.dmp xloader -
Executes dropped EXE 3 IoCs
Processes:
Ouzrnaxufxjssnkcombined.exe20snkprotect.exe40snkprotect.exepid process 4368 Ouzrnaxufxjssnkcombined.exe 3052 20snkprotect.exe 3768 40snkprotect.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Jvhmoaft.exeOuzrnaxufxjssnkcombined.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Jvhmoaft.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Ouzrnaxufxjssnkcombined.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 checkip.dyndns.org -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Jvhmoaft.exeJvhmoaft.exesvchost.exedescription pid process target process PID 488 set thread context of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 3880 set thread context of 2416 3880 Jvhmoaft.exe Explorer.EXE PID 5060 set thread context of 2416 5060 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1528 3768 WerFault.exe 40snkprotect.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4640 timeout.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
Processes:
powershell.exeJvhmoaft.exeJvhmoaft.exe40snkprotect.exesvchost.exepid process 1276 powershell.exe 1276 powershell.exe 488 Jvhmoaft.exe 488 Jvhmoaft.exe 3880 Jvhmoaft.exe 3880 Jvhmoaft.exe 3880 Jvhmoaft.exe 3880 Jvhmoaft.exe 3768 40snkprotect.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe 5060 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2416 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Jvhmoaft.exesvchost.exepid process 3880 Jvhmoaft.exe 3880 Jvhmoaft.exe 3880 Jvhmoaft.exe 5060 svchost.exe 5060 svchost.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Jvhmoaft.exepowershell.exeJvhmoaft.exe40snkprotect.exeExplorer.EXEsvchost.exedescription pid process Token: SeDebugPrivilege 488 Jvhmoaft.exe Token: SeDebugPrivilege 1276 powershell.exe Token: SeDebugPrivilege 3880 Jvhmoaft.exe Token: SeDebugPrivilege 3768 40snkprotect.exe Token: SeShutdownPrivilege 2416 Explorer.EXE Token: SeCreatePagefilePrivilege 2416 Explorer.EXE Token: SeShutdownPrivilege 2416 Explorer.EXE Token: SeCreatePagefilePrivilege 2416 Explorer.EXE Token: SeShutdownPrivilege 2416 Explorer.EXE Token: SeCreatePagefilePrivilege 2416 Explorer.EXE Token: SeShutdownPrivilege 2416 Explorer.EXE Token: SeCreatePagefilePrivilege 2416 Explorer.EXE Token: SeDebugPrivilege 5060 svchost.exe Token: SeShutdownPrivilege 2416 Explorer.EXE Token: SeCreatePagefilePrivilege 2416 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Ouzrnaxufxjssnkcombined.exepid process 4368 Ouzrnaxufxjssnkcombined.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
Jvhmoaft.execmd.exeOuzrnaxufxjssnkcombined.exe20snkprotect.exeExplorer.EXEfondue.exesvchost.exedescription pid process target process PID 488 wrote to memory of 1276 488 Jvhmoaft.exe powershell.exe PID 488 wrote to memory of 1276 488 Jvhmoaft.exe powershell.exe PID 488 wrote to memory of 1276 488 Jvhmoaft.exe powershell.exe PID 488 wrote to memory of 4956 488 Jvhmoaft.exe cmd.exe PID 488 wrote to memory of 4956 488 Jvhmoaft.exe cmd.exe PID 488 wrote to memory of 4956 488 Jvhmoaft.exe cmd.exe PID 4956 wrote to memory of 4640 4956 cmd.exe timeout.exe PID 4956 wrote to memory of 4640 4956 cmd.exe timeout.exe PID 4956 wrote to memory of 4640 4956 cmd.exe timeout.exe PID 488 wrote to memory of 4368 488 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 488 wrote to memory of 4368 488 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 488 wrote to memory of 4368 488 Jvhmoaft.exe Ouzrnaxufxjssnkcombined.exe PID 488 wrote to memory of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 488 wrote to memory of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 488 wrote to memory of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 488 wrote to memory of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 488 wrote to memory of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 488 wrote to memory of 3880 488 Jvhmoaft.exe Jvhmoaft.exe PID 4368 wrote to memory of 3052 4368 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 4368 wrote to memory of 3052 4368 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 4368 wrote to memory of 3052 4368 Ouzrnaxufxjssnkcombined.exe 20snkprotect.exe PID 4368 wrote to memory of 3768 4368 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 4368 wrote to memory of 3768 4368 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 4368 wrote to memory of 3768 4368 Ouzrnaxufxjssnkcombined.exe 40snkprotect.exe PID 3052 wrote to memory of 180 3052 20snkprotect.exe fondue.exe PID 3052 wrote to memory of 180 3052 20snkprotect.exe fondue.exe PID 3052 wrote to memory of 180 3052 20snkprotect.exe fondue.exe PID 2416 wrote to memory of 5060 2416 Explorer.EXE svchost.exe PID 2416 wrote to memory of 5060 2416 Explorer.EXE svchost.exe PID 2416 wrote to memory of 5060 2416 Explorer.EXE svchost.exe PID 180 wrote to memory of 1176 180 fondue.exe FonDUE.EXE PID 180 wrote to memory of 1176 180 fondue.exe FonDUE.EXE PID 5060 wrote to memory of 3688 5060 svchost.exe cmd.exe PID 5060 wrote to memory of 3688 5060 svchost.exe cmd.exe PID 5060 wrote to memory of 3688 5060 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe"C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA2AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 353⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 354⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe"C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe"C:\Users\Admin\AppData\Local\Temp\20snkprotect.exe" 04⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll6⤵
-
C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe"C:\Users\Admin\AppData\Local\Temp\40snkprotect.exe" 04⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 15205⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exeC:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Jvhmoaft.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3768 -ip 37681⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\20snkprotect.exeMD5
1b5cdaae707008b8060676c238623313
SHA19c43145e129634d31e0f664a9c3f467ba235ce6c
SHA2566c39d7763e7bb0df8a0ad0ab1ebd0252b53499d45900b6df2987020429206edd
SHA512471fec457640fd594bcdd39647293ac9fff5911dcfb5f795141e82c796109aa34d468d42707f5079bafefd2a0b1567130a78e553f65fb29f96cd686688e12de1
-
C:\Users\Admin\AppData\Local\Temp\20snkprotect.exeMD5
1b5cdaae707008b8060676c238623313
SHA19c43145e129634d31e0f664a9c3f467ba235ce6c
SHA2566c39d7763e7bb0df8a0ad0ab1ebd0252b53499d45900b6df2987020429206edd
SHA512471fec457640fd594bcdd39647293ac9fff5911dcfb5f795141e82c796109aa34d468d42707f5079bafefd2a0b1567130a78e553f65fb29f96cd686688e12de1
-
C:\Users\Admin\AppData\Local\Temp\40snkprotect.exeMD5
aa7372ee69da4eca16f92ee98bf53a7b
SHA1e76529db49cba47cb2a32d4dd64472fcf72f0a11
SHA256871a0b2fa5664bd5ed819edb7c037b81b2b552e4ab9eec6f87adbf32d51365ef
SHA5125444e8ea89257504ef62ce6e2c7481fdcb8a64fb87f3dbc0e64130ad39bee45cfe075d8511ba93ad49c098d3f8d2a821226709421d3c341157441fef7b003151
-
C:\Users\Admin\AppData\Local\Temp\40snkprotect.exeMD5
aa7372ee69da4eca16f92ee98bf53a7b
SHA1e76529db49cba47cb2a32d4dd64472fcf72f0a11
SHA256871a0b2fa5664bd5ed819edb7c037b81b2b552e4ab9eec6f87adbf32d51365ef
SHA5125444e8ea89257504ef62ce6e2c7481fdcb8a64fb87f3dbc0e64130ad39bee45cfe075d8511ba93ad49c098d3f8d2a821226709421d3c341157441fef7b003151
-
C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exeMD5
87ff3063dc995f8b0d49237caf49996a
SHA17feada75d9c02dac44c97cd913633ec12b1ceef6
SHA256645bc6053b810ba900a1ad4955d90b0a9f3d1d46caf3bf3523df10a940752050
SHA512ec55ebda6e741f596ddae8d19601f7eabee2afda9b448d66df603e39dcaf51801fec7f7efe29200c46eb5aa9d98db1ae0ab619e4f115b8d428c32823eed89a3c
-
C:\Users\Admin\AppData\Local\Temp\Ouzrnaxufxjssnkcombined.exeMD5
87ff3063dc995f8b0d49237caf49996a
SHA17feada75d9c02dac44c97cd913633ec12b1ceef6
SHA256645bc6053b810ba900a1ad4955d90b0a9f3d1d46caf3bf3523df10a940752050
SHA512ec55ebda6e741f596ddae8d19601f7eabee2afda9b448d66df603e39dcaf51801fec7f7efe29200c46eb5aa9d98db1ae0ab619e4f115b8d428c32823eed89a3c
-
memory/180-154-0x0000000000000000-mapping.dmp
-
memory/488-130-0x0000000000800000-0x0000000000810000-memory.dmpFilesize
64KB
-
memory/1176-165-0x0000000000000000-mapping.dmp
-
memory/1276-140-0x0000000006DB0000-0x0000000006DCA000-memory.dmpFilesize
104KB
-
memory/1276-134-0x00000000058E0000-0x0000000005902000-memory.dmpFilesize
136KB
-
memory/1276-132-0x0000000005310000-0x0000000005346000-memory.dmpFilesize
216KB
-
memory/1276-133-0x0000000005980000-0x0000000005FA8000-memory.dmpFilesize
6.2MB
-
memory/1276-138-0x00000000052C5000-0x00000000052C7000-memory.dmpFilesize
8KB
-
memory/1276-137-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/1276-131-0x0000000000000000-mapping.dmp
-
memory/1276-135-0x00000000061E0000-0x0000000006246000-memory.dmpFilesize
408KB
-
memory/1276-139-0x0000000007F10000-0x000000000858A000-memory.dmpFilesize
6.5MB
-
memory/1276-136-0x0000000006250000-0x00000000062B6000-memory.dmpFilesize
408KB
-
memory/2416-164-0x0000000007C20000-0x0000000007DB9000-memory.dmpFilesize
1.6MB
-
memory/2416-172-0x0000000007DC0000-0x0000000007F19000-memory.dmpFilesize
1.3MB
-
memory/3052-150-0x0000000000000000-mapping.dmp
-
memory/3688-169-0x0000000000000000-mapping.dmp
-
memory/3768-152-0x0000000000000000-mapping.dmp
-
memory/3768-160-0x0000000004C80000-0x0000000004D1C000-memory.dmpFilesize
624KB
-
memory/3768-157-0x00000000003F0000-0x0000000000416000-memory.dmpFilesize
152KB
-
memory/3768-159-0x0000000005230000-0x00000000057D4000-memory.dmpFilesize
5.6MB
-
memory/3880-148-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3880-162-0x0000000001210000-0x000000000155A000-memory.dmpFilesize
3.3MB
-
memory/3880-161-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3880-146-0x0000000000000000-mapping.dmp
-
memory/3880-163-0x0000000001170000-0x0000000001181000-memory.dmpFilesize
68KB
-
memory/4368-143-0x0000000000000000-mapping.dmp
-
memory/4640-142-0x0000000000000000-mapping.dmp
-
memory/4956-141-0x0000000000000000-mapping.dmp
-
memory/5060-166-0x0000000000000000-mapping.dmp
-
memory/5060-168-0x0000000000880000-0x00000000008A9000-memory.dmpFilesize
164KB
-
memory/5060-167-0x0000000000BD0000-0x0000000000BDE000-memory.dmpFilesize
56KB
-
memory/5060-170-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/5060-171-0x0000000001200000-0x0000000001290000-memory.dmpFilesize
576KB