Overview

overview

10

Static

static

RFQ-11015-12.exe

windows10-1703-x64

10

RFQ-11015-12.exe

windows10-2004-x64

10

Resubmissions

03-10-2022 05:52

221003-gky5qaacg7 10

02-10-2022 10:41

221002-mq3yradabj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RFQ-11015-12.exe

  • Size

    27KB

  • Sample

    221003-gky5qaacg7

  • MD5

    a1dc1cff823fcdd66b73eef2e7c32715

  • SHA1

    451cd2d2033b8774dab60a954e158c7aafaf2d47

  • SHA256

    6200e8758a22991d5ac0af555cbe25f8d2b59ca0f5f212402d8ec805c7f5cfe7

  • SHA512

    e105618d9863401f9ee56b7eb6ff826bb5b4bef76cef0b5b6b211c839b8ff7ed9277381c243f5e2855609c42c6ae1f74082c962398e5ebd2ed81a326d44e3623

  • SSDEEP

    384:Nukgi2WJFHHMleT2gL1CAOh05PjoaYLR/NLXFqgnZE3eCjRyY+vGyox8u5/DpW+v:shKMM2jOj+RVLp4Vh+eyM8upJ

Score
10/10
snakekeyloggercollectionkeyloggerpersistencestealer

Malware Config

Targets

    • Target

      RFQ-11015-12.exe

    • Size

      27KB

    • MD5

      a1dc1cff823fcdd66b73eef2e7c32715

    • SHA1

      451cd2d2033b8774dab60a954e158c7aafaf2d47

    • SHA256

      6200e8758a22991d5ac0af555cbe25f8d2b59ca0f5f212402d8ec805c7f5cfe7

    • SHA512

      e105618d9863401f9ee56b7eb6ff826bb5b4bef76cef0b5b6b211c839b8ff7ed9277381c243f5e2855609c42c6ae1f74082c962398e5ebd2ed81a326d44e3623

    • SSDEEP

      384:Nukgi2WJFHHMleT2gL1CAOh05PjoaYLR/NLXFqgnZE3eCjRyY+vGyox8u5/DpW+v:shKMM2jOj+RVLp4Vh+eyM8upJ

    Score
    10/10
    snakekeyloggercollectionkeyloggerpersistencestealer

    • Modifies WinLogon for persistence

      persistence

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks