Analysis
-
max time kernel
48s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
25-01-2023 10:41
General
-
Target
VSL Q88.exe
-
Size
17KB
-
MD5
abb62deff1e4851be179ab55fb65e4a7
-
SHA1
36d60ff07bcfdbe6c83c69079c954cc655bd9557
-
SHA256
35a1eb3544b13e48380568cef531dec8473aa229fa4fccc532898b2c514f05ab
-
SHA512
2e80e80a3c8b3aa4a2a49a8bdc618f464f399e98da68dac4a558282dc237cdd7e4a899969695661af3d462d0c46e211bbd9ae1ee8a55658f724d852cd98b1e6b
-
SSDEEP
384:eBHyHMiAiIufjm2g6WeLLB3mDTQ8T3Jd:YHyHMi0ufj3H5F3mDF3T
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1897716112:AAEAtOCkOV8umHBB93Og24bkiIdUKReGK44/sendMessage?chat_id=1745211648
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload ⋅ 6 IoCs
-
Reads data files stored by FTP clients ⋅ 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients ⋅ 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers ⋅ 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles ⋅ 1 TTPs 3 IoCs
-
Adds Run key to start application ⋅ 2 TTPs 1 IoCs
-
Looks up external IP address via web service ⋅ 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext ⋅ 1 IoCs
-
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses ⋅ 3 IoCs
-
Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
-
Suspicious use of WriteProcessMemory ⋅ 13 IoCs
-
outlook_office_path ⋅ 1 IoCs
-
outlook_win_path ⋅ 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VSL Q88.exePID:2024"C:\Users\Admin\AppData\Local\Temp\VSL Q88.exe"Adds Run key to start applicationSuspicious use of SetThreadContextSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:620"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\VSL Q88.exePID:1816"C:\Users\Admin\AppData\Local\Temp\VSL Q88.exe"Accesses Microsoft Outlook profilesSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenoutlook_office_pathoutlook_win_path
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
memory/620-58-0x0000000000000000-mapping.dmp
-
memory/620-62-0x000000006F660000-0x000000006FC0B000-memory.dmp
-
memory/620-61-0x000000006F660000-0x000000006FC0B000-memory.dmp
-
memory/620-60-0x000000006F660000-0x000000006FC0B000-memory.dmp
-
memory/1816-69-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/1816-64-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/1816-67-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/1816-65-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/1816-70-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/1816-71-0x000000000042079E-mapping.dmp
-
memory/1816-73-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/1816-75-0x0000000000400000-0x0000000000426000-memory.dmp
-
memory/2024-57-0x0000000005530000-0x00000000055C2000-memory.dmp
-
memory/2024-56-0x0000000005B30000-0x0000000005C92000-memory.dmp
-
memory/2024-55-0x00000000759F1000-0x00000000759F3000-memory.dmp
-
memory/2024-63-0x0000000005220000-0x0000000005268000-memory.dmp
-
memory/2024-54-0x0000000000870000-0x000000000087A000-memory.dmp