Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2022, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
SOLICITUD DE OFERTA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SOLICITUD DE OFERTA.exe
Resource
win10v2004-20220812-en
General
-
Target
SOLICITUD DE OFERTA.exe
-
Size
584KB
-
MD5
b054f014538d20144233d8f91bcf6707
-
SHA1
4f4d602570d9dbdd7206f4161eaa8ee815049b07
-
SHA256
bc24cb4f4f62067fa75d7dde37d2036b1c179c1554bfe66af8f3bb823fdce4de
-
SHA512
a5740d9dac0a2fdb68d133ba61aba452bfcdc6138ed445f4bacd73cdb47050a4cc0f0f4d6d474fa9302bf080996de7a2466e111a36ce0d44a64f29c75028050e
-
SSDEEP
12288:+UVN8v42n9NGRXE4G8GzLHpAavZN43Y3APQB:BY4ASm8yaavZN4I3AY
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.hemegas.es - Port:
587 - Username:
[email protected] - Password:
@Bastilipo1 - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/1640-135-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4864 set thread context of 1640 4864 SOLICITUD DE OFERTA.exe 80 -
Program crash 1 IoCs
pid pid_target Process procid_target 4420 1640 WerFault.exe 80 -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe 1640 CasPol.exe 4864 SOLICITUD DE OFERTA.exe 4864 SOLICITUD DE OFERTA.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4864 SOLICITUD DE OFERTA.exe Token: SeDebugPrivilege 1640 CasPol.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80 PID 4864 wrote to memory of 1640 4864 SOLICITUD DE OFERTA.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE OFERTA.exe"C:\Users\Admin\AppData\Local\Temp\SOLICITUD DE OFERTA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 15763⤵
- Program crash
PID:4420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1640 -ip 16401⤵PID:1704