Overview

overview

10

Static

static

product Portfolio.exe

windows7-x64

10

product Portfolio.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    43s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    06-08-2022 07:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    product Portfolio.exe

  • Size

    269KB

  • MD5

    b9277f54b3aac9e4a23d0f09fbbb9327

  • SHA1

    553cefa73bc6ddbf1f82c4e8665c4eb4f031953e

  • SHA256

    280f622b9ab5cc5931427ada8c4f0976344fa63bfc82204cb7dfdc098a066717

  • SHA512

    af01fb0a5c87ec29a2f7b79f1bbca044c3bfa27e38f95e53564f7be345467a5b235e060246c16797e746ba19a6ce0e2d86606d721a3ca7665b38592cfd56f18e

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5200365593:AAGRpC_tWb3avAayYSeKw5B6h5VRh7b19kU/sendMessage?chat_id=1482312326

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe
    "C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe
      "C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe"
      2⤵
        PID:1476
      • C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe
        "C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe"
        2⤵
          PID:1680
        • C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe
          "C:\Users\Admin\AppData\Local\Temp\product Portfolio.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1648

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Credentials in Files

      3
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1648-58-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/1648-59-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/1648-61-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/1648-63-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/1648-64-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/1648-65-0x000000000042014E-mapping.dmp
        Download
      • memory/1648-67-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/1648-69-0x0000000000400000-0x0000000000426000-memory.dmp
        Filesize

        152KB

        Download
      • memory/2032-54-0x00000000002D0000-0x000000000031A000-memory.dmp
        Filesize

        296KB

        Download
      • memory/2032-55-0x0000000000280000-0x00000000002C2000-memory.dmp
        Filesize

        264KB

        Download
      • memory/2032-56-0x0000000075C51000-0x0000000075C53000-memory.dmp
        Filesize

        8KB

        Download
      • memory/2032-57-0x0000000000390000-0x00000000003A6000-memory.dmp
        Filesize

        88KB

        Download