Analysis
-
max time kernel
104s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
28-11-2022 06:31
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.19575.15091.exe
-
Size
1.0MB
-
MD5
3672cbf3d4df3e8b980ca53da0be22af
-
SHA1
056122bc3ff2e7fc0f7daf12c4bde24dab554aba
-
SHA256
093ae32e384e0781c6840738467880b8a18eeac99a9124e2b03431f054ccbba2
-
SHA512
fbda4615c2984b80db5e970422340912fb84b8a1e8de23c277ed42de36b07525879f0f45ef530989598c22ccf07e0098cadc5d8025a5e9eefc5f2b5cbd09ef7b
-
SSDEEP
24576:ukdGOopzAI3ZnpSLixvrpgDMBse8UOiJoLSwybN9X:v1opLNjeuse8UOxu3
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.19575.15091.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.19575.15091.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [System.Security.Principal.WindowsIdentity]::GetCurrent().Name2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.19575.15091.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.19575.15091.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD533b19d75aa77114216dbc23f43b195e3
SHA136a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD58be54877ded85f98bbd47f05e8f7d7fa
SHA1ed4db3d8b3388a707042abde573f633cb1e15a5e
SHA25695b4568a9c0c1aa15b23c84705854cb9000dc077ecb6dcae2d49eb165b66b4d8
SHA512805725b1035ef0798306b037b10e1cd5dedf3004438ece74751830157bae59b64a224e7405d45372f25050b6355359ff0bffff6a83cb6384c5e7de31e994a2e4
-
memory/2472-151-0x0000000006CE0000-0x0000000006EA2000-memory.dmpFilesize
1.8MB
-
memory/2472-150-0x0000000005760000-0x00000000057FC000-memory.dmpFilesize
624KB
-
memory/2472-149-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2472-148-0x0000000000000000-mapping.dmp
-
memory/3536-137-0x0000000002A30000-0x0000000002A66000-memory.dmpFilesize
216KB
-
memory/3536-139-0x0000000005260000-0x0000000005282000-memory.dmpFilesize
136KB
-
memory/3536-140-0x0000000005B80000-0x0000000005BE6000-memory.dmpFilesize
408KB
-
memory/3536-141-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/3536-142-0x0000000006340000-0x000000000635E000-memory.dmpFilesize
120KB
-
memory/3536-135-0x0000000000000000-mapping.dmp
-
memory/3536-138-0x00000000054E0000-0x0000000005B08000-memory.dmpFilesize
6.2MB
-
memory/3556-145-0x0000000006B40000-0x0000000006B5A000-memory.dmpFilesize
104KB
-
memory/3556-144-0x0000000007E60000-0x00000000084DA000-memory.dmpFilesize
6.5MB
-
memory/3556-143-0x0000000000000000-mapping.dmp
-
memory/4884-132-0x0000000000CA0000-0x0000000000DAC000-memory.dmpFilesize
1.0MB
-
memory/4884-136-0x0000000005800000-0x000000000580A000-memory.dmpFilesize
40KB
-
memory/4884-134-0x0000000005B80000-0x0000000005C12000-memory.dmpFilesize
584KB
-
memory/4884-133-0x0000000005E90000-0x0000000006434000-memory.dmpFilesize
5.6MB