Analysis
- max time kernel
146s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
05/10/2022, 09:11
General
- Target Purchase Order-6630T.exe
- Size 1.3MB
- Sample221005-k5llxaeafk
- SHA256 57ded1368d1a4e13a6220b144f2b78cc91e915fccd66a9193bc2d9fe8d758432
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.shaqone.shop
-
Port
587
-
Username
-
Password
qPV%6P+jrcf3hV8WFP
-
Email to
Extracted
-
wshrat
-
http://rze6.sytes.net:4000
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
- Blocklisted process makes network request 17 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 9 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
- Script User-Agent 17 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-6630T.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-6630T.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jemfblxeusczzbuild.js"2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Jemfblxeusczzbuild.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-6630T.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-6630T.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order-6630T.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order-6630T.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Purchase Order-6630T.exe.log
Jemfblxeusczzbuild.js
Jemfblxeusczzbuild.js
Jemfblxeusczzbuild.js
memory/2960-141-0x0000000006240000-0x000000000625A000-memory.dmp
memory/2960-135-0x00000000047A0000-0x00000000047D6000-memory.dmp
memory/2960-137-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/2960-139-0x0000000005D50000-0x0000000005D6E000-memory.dmp
memory/2960-136-0x0000000004F50000-0x0000000005578000-memory.dmp
memory/2960-140-0x00000000073B0000-0x0000000007A2A000-memory.dmp
memory/2960-138-0x0000000005710000-0x0000000005776000-memory.dmp
memory/3392-152-0x0000000005180000-0x000000000521C000-memory.dmp
memory/3392-147-0x0000000000400000-0x0000000000426000-memory.dmp
memory/3392-151-0x0000000005730000-0x0000000005CD4000-memory.dmp
memory/3392-153-0x00000000065A0000-0x0000000006762000-memory.dmp
memory/3392-154-0x0000000006770000-0x0000000006802000-memory.dmp
memory/3392-155-0x0000000006520000-0x000000000652A000-memory.dmp
memory/5016-133-0x00000000054D0000-0x00000000054F2000-memory.dmp
memory/5016-132-0x0000000000130000-0x0000000000280000-memory.dmp