Analysis
-
max time kernel
88s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 12:53
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.22893.1871.exe
-
Size
1.0MB
-
MD5
7ca92417363d4d097a154f647e3b27d7
-
SHA1
c8321f40936b067b0d5ce7a00761b9444a0aadcf
-
SHA256
6dd782b913078f4262454ad9e57424f755c4b961b311008e0f4603e44cfaafce
-
SHA512
0fa982c9da9e4be98f415f87d43ab47a9a3790c3394db93b45614240fe5b422be5f76dcce4f5e864fafedc3860cc54d616203d27f161181b891f19e1c08e4ace
-
SSDEEP
24576:sztjgh/awCSglIs8fvJXqI7RMLarGRl/S2Dz:szt8h/dpvfVn7RRG/t
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 6 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22893.1871.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22893.1871.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22893.1871.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qdwbABuGIK.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qdwbABuGIK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp10B4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22893.1871.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.22893.1871.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp10B4.tmpFilesize
1KB
MD5543a992caacc8b82f072326f82c6e2fd
SHA189efe2836ba639f91cf4111ef829b38c4c663cb6
SHA2561f0319115fd3e140cc40b5516ab70c649d84c7f35b424f10c91cca18adf01303
SHA512ffdccd1384ac2ce824e6dfe80043db4433e43c92314b89df0c3aa5fd63ad5b32061d89e892124c4914bc4e70e2a78c0fa195236b53be113daa39538a5b71814a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD519f80ffc2b42e7fadabbc523861f149a
SHA1156be6ce078608e0ab19a19f4e07cbf1758d1bcf
SHA256b668c53031710b215f60a5656a3e26315285c1e9cd785f4999091cb419962824
SHA512da789b30cea8e5ed30b67f0e90f7316aa2e25bdf690a0689199c10e140f66132bf8095f78d96ed98c0aefed2f764f9b5150ad3a7fe606b28643ce5cf609ba8b0
-
memory/816-83-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/816-80-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/816-59-0x0000000000000000-mapping.dmp
-
memory/884-82-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/884-81-0x000000006EE70000-0x000000006F41B000-memory.dmpFilesize
5.7MB
-
memory/884-61-0x0000000000000000-mapping.dmp
-
memory/972-63-0x0000000000000000-mapping.dmp
-
memory/1720-66-0x0000000005C00000-0x0000000005C62000-memory.dmpFilesize
392KB
-
memory/1720-58-0x0000000008000000-0x000000000809A000-memory.dmpFilesize
616KB
-
memory/1720-55-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1720-56-0x0000000000530000-0x0000000000548000-memory.dmpFilesize
96KB
-
memory/1720-54-0x0000000001140000-0x0000000001248000-memory.dmpFilesize
1.0MB
-
memory/1720-57-0x0000000000550000-0x000000000055C000-memory.dmpFilesize
48KB
-
memory/1824-70-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-74-0x000000000042064E-mapping.dmp
-
memory/1824-78-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-76-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-72-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-73-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-68-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1824-67-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB