Analysis
- max time kernel
122s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
11/04/2022, 07:11
General
- Target 8b400a32494c0b3fa2c543dca37c9ddc.exe
- Size 623KB
- Sample220411-hzyceabdbr
- SHA256 c18d6936ad91ca2fc6f7ee7b148cde690000709cc68a379011c6eedc8bcd8598
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.erocktax.com
-
Port
587
-
Username
-
Password
erock2016
-
Email to
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b400a32494c0b3fa2c543dca37c9ddc.exe"C:\Users\Admin\AppData\Local\Temp\8b400a32494c0b3fa2c543dca37c9ddc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NRRNEoimKZfb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NRRNEoimKZfb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF486.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\8b400a32494c0b3fa2c543dca37c9ddc.exe"C:\Users\Admin\AppData\Local\Temp\8b400a32494c0b3fa2c543dca37c9ddc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 15523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2844 -ip 28441⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmpF486.tmp
memory/224-142-0x0000000006F60000-0x0000000006F7E000-memory.dmp
memory/224-147-0x0000000007F30000-0x0000000007FC6000-memory.dmp
memory/224-150-0x0000000007FD0000-0x0000000007FD8000-memory.dmp
memory/224-149-0x0000000007FF0000-0x000000000800A000-memory.dmp
memory/224-148-0x0000000007EE0000-0x0000000007EEE000-memory.dmp
memory/224-138-0x0000000006280000-0x00000000062E6000-memory.dmp
memory/224-132-0x0000000003090000-0x00000000030C6000-memory.dmp
memory/224-146-0x0000000007D20000-0x0000000007D2A000-memory.dmp
memory/224-134-0x0000000005BE0000-0x0000000006208000-memory.dmp
memory/224-145-0x0000000007CB0000-0x0000000007CCA000-memory.dmp
memory/224-143-0x00000000031D5000-0x00000000031D7000-memory.dmp
memory/224-139-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/224-137-0x0000000005A00000-0x0000000005A22000-memory.dmp
memory/224-144-0x00000000082F0000-0x000000000896A000-memory.dmp
memory/224-140-0x0000000006F80000-0x0000000006FB2000-memory.dmp
memory/224-141-0x0000000070570000-0x00000000705BC000-memory.dmp
memory/2844-136-0x0000000000400000-0x0000000000426000-memory.dmp
memory/4312-124-0x0000000000040000-0x00000000000E2000-memory.dmp
memory/4312-126-0x0000000004AA0000-0x0000000004B32000-memory.dmp
memory/4312-125-0x0000000004FA0000-0x0000000005544000-memory.dmp
memory/4312-129-0x00000000087F0000-0x0000000008856000-memory.dmp
memory/4312-128-0x0000000008390000-0x000000000842C000-memory.dmp
memory/4312-127-0x0000000004B50000-0x0000000004B5A000-memory.dmp