Overview

overview

10

Static

static

UPDATTED SOA.exe

windows7-x64

10

UPDATTED SOA.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-10-2022 06:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    UPDATTED SOA.exe

  • Size

    1.0MB

  • MD5

    7a6b0980328902701e46b0e67288b565

  • SHA1

    18eece768efd6b51990336bd7d580902db79f951

  • SHA256

    8c456876915598dc988732791d60ea7129c1f03f9eabd10951ce2996c9c0997f

  • SHA512

    e167579fbe129b819fc79581a34fc58c0fefb773ca7bc0e98b7024435cc0c8f0df7fbe86be21ecf338eedb7aeb442c8ec0a7b67a44330c1c219683f560bd168e

  • SSDEEP

    12288:NikVrArSr9kMp1txX2iNoADqjJ5nmZhS/NFMWINKJmAtnn+F3ORwspu:xrArSrBv1Qjr+NoJm4+F3+A

Score
10/10
snakekeyloggercollectionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5227573794:AAECZBnQSxLs0aOVsV2wnclC6-WKnxPpi_k/sendMessage?chat_id=5217421430

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe
    "C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AbTipQpaHT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD4E.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4128
    • C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe
      "{path}"
      2⤵
        PID:4428
      • C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe
        "{path}"
        2⤵
          PID:1504
        • C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe
          "{path}"
          2⤵
            PID:2288
          • C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe
            "{path}"
            2⤵
              PID:4132
            • C:\Users\Admin\AppData\Local\Temp\UPDATTED SOA.exe
              "{path}"
              2⤵
              • Accesses Microsoft Outlook profiles
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • outlook_office_path
              • outlook_win_path
              PID:4504

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Defense Evasion

          Credential Access

          Credentials in Files

          3
          T1081

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Email Collection

          1
          T1114

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tmpD4E.tmp
            Filesize

            1KB

            MD5

            a1d97bb875a123765ef75d00a66983e1

            SHA1

            a532a483ed111a748c4eabedb69711247f609ee6

            SHA256

            1f90aed1208c9fd18d779bd42a0d3610ce3b3303407bf6f9f10a6b10a2ac89a1

            SHA512

            8e828b59fe28e386c6b24a8a70890498dddb2d1bb1b69622e8a0954dc5750a93fae87f14525f84338183e9ce2886b2d6b190813a58ca2b9dba513843180910ae

            Download Submit
          • memory/1504-140-0x0000000000000000-mapping.dmp
            Download
          • memory/2288-141-0x0000000000000000-mapping.dmp
            Download
          • memory/2424-135-0x0000000004D60000-0x0000000004DFC000-memory.dmp
            Filesize

            624KB

            Download
          • memory/2424-136-0x0000000004C40000-0x0000000004C4A000-memory.dmp
            Filesize

            40KB

            Download
          • memory/2424-134-0x0000000004CC0000-0x0000000004D52000-memory.dmp
            Filesize

            584KB

            Download
          • memory/2424-133-0x00000000051D0000-0x0000000005774000-memory.dmp
            Filesize

            5.6MB

            Download
          • memory/2424-132-0x0000000000190000-0x0000000000298000-memory.dmp
            Filesize

            1.0MB

            Download
          • memory/4128-137-0x0000000000000000-mapping.dmp
            Download
          • memory/4132-142-0x0000000000000000-mapping.dmp
            Download
          • memory/4428-139-0x0000000000000000-mapping.dmp
            Download
          • memory/4504-143-0x0000000000000000-mapping.dmp
            Download
          • memory/4504-144-0x0000000000400000-0x0000000000426000-memory.dmp
            Filesize

            152KB

            Download
          • memory/4504-145-0x0000000006650000-0x0000000006812000-memory.dmp
            Filesize

            1.8MB

            Download