Overview

overview

10

Static

static

SecuriteIn...25.exe

windows7-x64

10

SecuriteIn...25.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2022 10:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.3782.29425.exe

  • Size

    1012KB

  • MD5

    b6627ede2d8cc7c41ce2b1ae6ce90637

  • SHA1

    6f9fee2681177e07dbd65559574c24786583b134

  • SHA256

    0983653ed943e88580b04dc228483a8661c89a282fa0f01e097fd238b4631427

  • SHA512

    a7a7cc6d960b9f122a8a159b50a65f56ab32aba194be401712584ea518b44077965f7f0d298f7de1d3a7739b80a0d31553af6bbf4edefc2d541598cac748a460

  • SSDEEP

    12288:QJUA7pUZkrmdos1dxk8irwhuJLzps7mqADPp5rOGz192nwEpcbLrrrv9jlg:kCdVdxkMuJ5s7mqGTrKwgcbL7vt+

Score
10/10
snakekeyloggercollectionevasionkeyloggerspywarestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3782.29425.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3782.29425.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3782.29425.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1764
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sPheGspytcaL.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1408
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sPheGspytcaL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE4A5.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:896
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3782.29425.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.3782.29425.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:804
      • C:\Windows\SysWOW64\REG.exe
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
        3⤵
        • Disables RegEdit via registry modification
        • Modifies registry key
        PID:992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpE4A5.tmp
    Filesize

    1KB

    MD5

    2f02cd9364a7c01b2ebc86d9346531a3

    SHA1

    0bcc45fb66bc67aad55927ea1b0678a6b0be7c49

    SHA256

    8f82bc8d221bff947d8e3a58b7c42d9cfc1b4038c917366413c1cd7c04e76453

    SHA512

    fa3d1d82bb02937cfad165dfce8591bf7941cf15289dc2bb0e84ba23cb89993c7ad9fe331ab68ec3ea87acfffbd1c8f418c75ccf68a25fb0e8613d9ec9b0d95e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    1e874d5daba547043f87ac8c3ceeb3d7

    SHA1

    0923b6a4bf1884b54d67e7132071237121bdbd64

    SHA256

    733ef7b0385b6529bcaac5b0399e6ec95ea5f105e3f25cad504444f841b8a2d4

    SHA512

    8fe7ab76f396b8071e880e2a64681d9fe569b439a08e0d1fd562c11692249866625fe01339d2568551a8ab2d881eadbe5cf6d15739aee46c8dff64945c6b7bfb

    Download Submit

  • memory/540-59-0x0000000000F05000-0x0000000000F16000-memory.dmp

    Filesize

    68KB

    Download

  • memory/540-55-0x0000000076171000-0x0000000076173000-memory.dmp

    Filesize

    8KB

    Download

  • memory/540-58-0x0000000000F40000-0x0000000000FA2000-memory.dmp

    Filesize

    392KB

    Download

  • memory/540-83-0x0000000000F05000-0x0000000000F16000-memory.dmp

    Filesize

    68KB

    Download

  • memory/540-54-0x0000000000FA0000-0x00000000010A2000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/540-57-0x0000000000910000-0x000000000091C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/540-69-0x0000000004F70000-0x0000000004F98000-memory.dmp

    Filesize

    160KB

    Download

  • memory/540-56-0x00000000008E0000-0x00000000008FA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/804-79-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/804-70-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/804-71-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/804-73-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/804-75-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/804-81-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/804-76-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1408-67-0x000000006C9C0000-0x000000006CF6B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1408-85-0x000000006C9C0000-0x000000006CF6B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1764-84-0x000000006C9C0000-0x000000006CF6B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1764-68-0x000000006C9C0000-0x000000006CF6B000-memory.dmp

    Filesize

    5.7MB

    Download