Resubmissions
01-02-2023 17:02
230201-vj6p3aah39 1001-02-2023 17:00
230201-vjf5eacg4s 1001-02-2023 16:57
230201-vgbrxacg2y 10Analysis
-
max time kernel
370s -
max time network
440s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
01-02-2023 17:02
General
-
Target
Maersk Shipping Docs.exe
-
Size
618KB
-
MD5
44d5f28d8c991060173cb3656c41c5f8
-
SHA1
a84aae8b5f67d315ce5a38ad09ddef4400dbc0b4
-
SHA256
f9aa33269f7d56d6a16db1c91b5ce0df11fbe25c50d2c3f2222e07b83098d212
-
SHA512
55bd716b64c97da1b4dde39e7b0da03703ced82733a1cf6a6e33a236c2c66a3462bad1dba2218591e835a0d541d054b4e180b412b59493d7c660ddf420277d3b
-
SSDEEP
12288:BmsaDf3H2cE2pmlWmYwaiwHliNj6Weh3ih9HnA:BWWmcZs80BYTA
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5839027687:AAGrC4UWgd0JQxMHOf1dCehA-oSrYF_Bez8/sendMessage?chat_id=1094077450
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\laYtZHUX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\laYtZHUX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp23E3.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5dddb537ee4e18d10d4dbd2399339d020
SHA104fd04b7fbc4a4e4f60a399a70e0acdeea8c18c3
SHA2569522b95370518d97cb94f3f79def48cd9f15eccefcbab7c5476f9b5de0a7a4ff
SHA512cf69a29885c2b88d19c65e60c1c310c40390da16f7feafa737ee45835c26f7ce99d682f8cb47f6ce34c68d54f1ba91f9a1630ad535ad9075401870ddfb477d36
-
Filesize
1KB
MD5fff54515c1481c679f6c6a421eb13b70
SHA1c04db021c4acb85b0bca471e38e389d5a970ba00
SHA256eeeeb83d350c6e788602d1ee5d37f6e322031bc6045347e002f466b00dfc8f9f
SHA51270aa7fe9e6d7fa85d5c78ebc0bfbeaffd7eac31adae9ffb811fa7fe30f92efbb8b01bf877a7d2db4d9fc1fc14d5199e402be51b4aba194c8c1a367e3b5dd6e64
-
Filesize
660KB
-
Filesize
408KB
-
Filesize
592KB
-
Filesize
120KB
-
Filesize
204KB
-
Filesize
472KB
-
Filesize
300KB
-
Filesize
112KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
32KB
-
Filesize
152KB
-
Filesize
5.0MB
-
Filesize
1.8MB
-
Filesize
40KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
640KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
80KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
1.6MB
-
Filesize
392KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB