Analysis
-
max time kernel
91s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2022 21:07
Static task
static1
Behavioral task
behavioral1
Sample
5d5f7391169c9a4d9e8d8d6d437fba5b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5d5f7391169c9a4d9e8d8d6d437fba5b.exe
Resource
win10v2004-20220812-en
General
-
Target
5d5f7391169c9a4d9e8d8d6d437fba5b.exe
-
Size
910KB
-
MD5
5d5f7391169c9a4d9e8d8d6d437fba5b
-
SHA1
ea834ef87b5844a50af15fc17a76af9285d6e382
-
SHA256
a63aebfac0eced90932379e91a583fcfe4012e348bb17552b030e60eeff5bb11
-
SHA512
9f4aa586e8fcb96f59354ff8bf7915852383e94e8458ed61304921d908698bb9307d6b5b43d8d11bb0af656d3abac012d5c9119dbd5de80e1629c754a355e459
-
SSDEEP
12288:fF75emvRT7QmzoRtXoXYNgPwpNjVrCP80zl+VpvUzMp8jZ63b/9MihcuHY:fZ5lvCmzo3mYNHjh+8jpaMG83bljc0Y
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5351092646:AAFAsmwAtpab9AZfC8LrwLb4lvENCAIBMLg/sendMessage?chat_id=1636980888
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/776-144-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 5d5f7391169c9a4d9e8d8d6d437fba5b.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5d5f7391169c9a4d9e8d8d6d437fba5b.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5d5f7391169c9a4d9e8d8d6d437fba5b.exe Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5d5f7391169c9a4d9e8d8d6d437fba5b.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription pid process target process PID 4648 set thread context of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exepowershell.exe5d5f7391169c9a4d9e8d8d6d437fba5b.exepid process 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 1044 powershell.exe 776 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 1044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exepowershell.exe5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription pid process Token: SeDebugPrivilege 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeDebugPrivilege 776 5d5f7391169c9a4d9e8d8d6d437fba5b.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription pid process target process PID 4648 wrote to memory of 1044 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe powershell.exe PID 4648 wrote to memory of 1044 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe powershell.exe PID 4648 wrote to memory of 1044 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe powershell.exe PID 4648 wrote to memory of 3892 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe schtasks.exe PID 4648 wrote to memory of 3892 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe schtasks.exe PID 4648 wrote to memory of 3892 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe schtasks.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe PID 4648 wrote to memory of 776 4648 5d5f7391169c9a4d9e8d8d6d437fba5b.exe 5d5f7391169c9a4d9e8d8d6d437fba5b.exe -
outlook_office_path 1 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5d5f7391169c9a4d9e8d8d6d437fba5b.exe -
outlook_win_path 1 IoCs
Processes:
5d5f7391169c9a4d9e8d8d6d437fba5b.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5d5f7391169c9a4d9e8d8d6d437fba5b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d5f7391169c9a4d9e8d8d6d437fba5b.exe"C:\Users\Admin\AppData\Local\Temp\5d5f7391169c9a4d9e8d8d6d437fba5b.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IXOapxE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IXOapxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9B55.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\5d5f7391169c9a4d9e8d8d6d437fba5b.exe"C:\Users\Admin\AppData\Local\Temp\5d5f7391169c9a4d9e8d8d6d437fba5b.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9B55.tmpFilesize
1KB
MD5235c4714126abbe9e591bca26763f929
SHA191c4493b462b9c2bd38e0476b07ad1693b2b3bd0
SHA256e58ebf506a9938780d143d6914cdfa97cbf796ceb65265bb26153ca6fbe8c313
SHA512f068e0c1b1545ac6a55f55020178ca8c0e0a7a752b4fa364a9aec1328916945cf6aafedc109fad05ebecb337f0558619de90476291492d1d80496f15d1026384
-
memory/776-148-0x0000000006410000-0x00000000065D2000-memory.dmpFilesize
1.8MB
-
memory/776-143-0x0000000000000000-mapping.dmp
-
memory/776-144-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1044-138-0x0000000000000000-mapping.dmp
-
memory/1044-147-0x00000000062D0000-0x00000000062EE000-memory.dmpFilesize
120KB
-
memory/1044-158-0x0000000007910000-0x0000000007918000-memory.dmpFilesize
32KB
-
memory/1044-157-0x0000000007930000-0x000000000794A000-memory.dmpFilesize
104KB
-
memory/1044-140-0x00000000029E0000-0x0000000002A16000-memory.dmpFilesize
216KB
-
memory/1044-156-0x0000000007820000-0x000000000782E000-memory.dmpFilesize
56KB
-
memory/1044-142-0x0000000005440000-0x0000000005A68000-memory.dmpFilesize
6.2MB
-
memory/1044-155-0x0000000007870000-0x0000000007906000-memory.dmpFilesize
600KB
-
memory/1044-154-0x0000000007660000-0x000000000766A000-memory.dmpFilesize
40KB
-
memory/1044-145-0x0000000005B60000-0x0000000005B82000-memory.dmpFilesize
136KB
-
memory/1044-146-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/1044-153-0x00000000075F0000-0x000000000760A000-memory.dmpFilesize
104KB
-
memory/1044-152-0x0000000007C40000-0x00000000082BA000-memory.dmpFilesize
6.5MB
-
memory/1044-149-0x00000000068C0000-0x00000000068F2000-memory.dmpFilesize
200KB
-
memory/1044-150-0x0000000070B40000-0x0000000070B8C000-memory.dmpFilesize
304KB
-
memory/1044-151-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/3892-139-0x0000000000000000-mapping.dmp
-
memory/4648-133-0x0000000005E40000-0x00000000063E4000-memory.dmpFilesize
5.6MB
-
memory/4648-137-0x0000000005A40000-0x0000000005AA6000-memory.dmpFilesize
408KB
-
memory/4648-134-0x0000000005930000-0x00000000059C2000-memory.dmpFilesize
584KB
-
memory/4648-135-0x0000000005BD0000-0x0000000005BDA000-memory.dmpFilesize
40KB
-
memory/4648-136-0x00000000096A0000-0x000000000973C000-memory.dmpFilesize
624KB
-
memory/4648-132-0x0000000000F90000-0x000000000107A000-memory.dmpFilesize
936KB