Analysis
- max time kernel
74s - max time network
141s - platform
windows7_x64 - resource
win7-20220414-en - submitted
23/06/2022, 10:58
General
- Target 854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe
- Size 10KB
- Sample220623-m2s8pacfek
- SHA256 169632a9b4bc4b5783d765050b87e1fe720c505e13d0d22937b2a83a73dbe008
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot5412895406:AAEj-XWjEH6Xgz-M_j2Kpqqdv6KOeN4GaH0/sendMessage?chat_id=1467583453
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger Payload 6 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe"C:\Users\Admin\AppData\Local\Temp\854F1E97-5DBB-4A87-A566-33D9012B05E2 pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 502⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 503⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/584-65-0x0000000000400000-0x0000000000426000-memory.dmp
memory/584-66-0x0000000000400000-0x0000000000426000-memory.dmp
memory/584-71-0x0000000000400000-0x0000000000426000-memory.dmp
memory/584-61-0x0000000000400000-0x0000000000426000-memory.dmp
memory/584-60-0x0000000000400000-0x0000000000426000-memory.dmp
memory/584-63-0x0000000000400000-0x0000000000426000-memory.dmp
memory/584-69-0x0000000000400000-0x0000000000426000-memory.dmp
memory/656-55-0x00000000755A1000-0x00000000755A3000-memory.dmp
memory/656-54-0x0000000001140000-0x0000000001148000-memory.dmp
memory/656-57-0x0000000000DD0000-0x0000000000E1C000-memory.dmp
memory/656-56-0x0000000005E00000-0x0000000005EC2000-memory.dmp