Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
04-07-2022 18:21
Static task
static1
Behavioral task
behavioral1
Sample
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe
Resource
win10-20220414-en
General
-
Target
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe
-
Size
174KB
-
MD5
29e69c25d02c5a45e62f038f7aa7a716
-
SHA1
9aa09cd4c4126cd410a2674a37d34d1d7575d8b0
-
SHA256
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db
-
SHA512
b626b753d4e9daf4ab42e0fe00213600a12874822703c7d7c9fb6a2c8548885ad6f30b341c317780146ac5c7dacf11331071cc721c0cc9a411c4386dc6ee00e9
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1707668650:AAFJBUcmT6aGlXwy3-beDARhm0ji930DCzM/sendMessage?chat_id=-772314354
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3856-291-0x000000000042028E-mapping.dmp family_snakekeylogger behavioral1/memory/3856-325-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rrfta = "\"C:\\Users\\Admin\\AppData\\Roaming\\Hbxhwj\\Rrfta.exe\"" cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exedescription pid process target process PID 3056 set thread context of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.execb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exeInstallUtil.exepid process 3360 powershell.exe 3360 powershell.exe 3360 powershell.exe 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe 3856 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe Token: SeDebugPrivilege 3360 powershell.exe Token: SeDebugPrivilege 3856 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exedescription pid process target process PID 3056 wrote to memory of 3360 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe powershell.exe PID 3056 wrote to memory of 3360 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe powershell.exe PID 3056 wrote to memory of 3360 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe powershell.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe PID 3056 wrote to memory of 3856 3056 cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe"C:\Users\Admin\AppData\Local\Temp\cb191c1c612b01447bd75c880c223fa73c82f9902bc6e6a26881031b0a9bf9db.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3056-116-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-117-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-118-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-120-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-119-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-121-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-122-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-124-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-123-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-125-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-126-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-127-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-128-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-129-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-130-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-132-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-131-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-135-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-137-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-136-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-134-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-133-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-138-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-139-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-140-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-142-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-144-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-143-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-141-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-145-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-146-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-147-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-149-0x0000000000EC0000-0x0000000000EF2000-memory.dmpFilesize
200KB
-
memory/3056-150-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-151-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-148-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-152-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-153-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-154-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-155-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-156-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-159-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-162-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-161-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-160-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-158-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-165-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-164-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-167-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-168-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-166-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-163-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-169-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-157-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-170-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-171-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-172-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-174-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-176-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-178-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-180-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-179-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-177-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-175-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-173-0x0000000077680000-0x000000007780E000-memory.dmpFilesize
1.6MB
-
memory/3056-189-0x00000000060A0000-0x0000000006130000-memory.dmpFilesize
576KB
-
memory/3056-190-0x00000000061A0000-0x00000000061EC000-memory.dmpFilesize
304KB
-
memory/3056-288-0x000000002BF30000-0x000000002BFC2000-memory.dmpFilesize
584KB
-
memory/3360-200-0x0000000000000000-mapping.dmp
-
memory/3360-236-0x0000000001260000-0x0000000001296000-memory.dmpFilesize
216KB
-
memory/3360-241-0x0000000006E50000-0x0000000007478000-memory.dmpFilesize
6.2MB
-
memory/3360-261-0x00000000074F0000-0x0000000007556000-memory.dmpFilesize
408KB
-
memory/3360-262-0x0000000007560000-0x00000000075C6000-memory.dmpFilesize
408KB
-
memory/3360-260-0x0000000006DE0000-0x0000000006E02000-memory.dmpFilesize
136KB
-
memory/3360-263-0x0000000007880000-0x0000000007BD0000-memory.dmpFilesize
3.3MB
-
memory/3360-266-0x00000000075F0000-0x000000000760C000-memory.dmpFilesize
112KB
-
memory/3360-267-0x0000000007BD0000-0x0000000007C1B000-memory.dmpFilesize
300KB
-
memory/3360-271-0x0000000007E70000-0x0000000007EE6000-memory.dmpFilesize
472KB
-
memory/3360-283-0x0000000008C60000-0x0000000008C7A000-memory.dmpFilesize
104KB
-
memory/3360-282-0x00000000095A0000-0x0000000009C18000-memory.dmpFilesize
6.5MB
-
memory/3856-291-0x000000000042028E-mapping.dmp
-
memory/3856-325-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3856-329-0x00000000058A0000-0x0000000005D9E000-memory.dmpFilesize
5.0MB
-
memory/3856-330-0x00000000053A0000-0x000000000543C000-memory.dmpFilesize
624KB
-
memory/3856-362-0x00000000062F0000-0x00000000064B2000-memory.dmpFilesize
1.8MB
-
memory/3856-365-0x0000000006160000-0x000000000616A000-memory.dmpFilesize
40KB