Overview
overview
10Static
static
100014c57bfd...3b.exe
windows7-x64
100014c57bfd...3b.exe
windows10-2004-x64
10660e3fcc23...81.exe
windows7-x64
7660e3fcc23...81.exe
windows10-2004-x64
79dc5600bed...30.exe
windows7-x64
109dc5600bed...30.exe
windows10-2004-x64
10Acwpn.exe
windows7-x64
10Acwpn.exe
windows10-2004-x64
7DHL SHIPPI...DF.exe
windows7-x64
10DHL SHIPPI...DF.exe
windows10-2004-x64
10Halkbank_E...f..exe
windows7-x64
10Halkbank_E...f..exe
windows10-2004-x64
10INVOICEXAN...LS.rtf
windows7-x64
10INVOICEXAN...LS.rtf
windows10-2004-x64
1Maersk Shi...cs.exe
windows7-x64
10Maersk Shi...cs.exe
windows10-2004-x64
10ORDER INQU...01.exe
windows7-x64
10ORDER INQU...01.exe
windows10-2004-x64
10PO-8372929.xls
windows7-x64
10PO-8372929.xls
windows10-2004-x64
1QUOTATION 1.rtf
windows7-x64
10QUOTATION 1.rtf
windows10-2004-x64
1Quotation.rtf
windows7-x64
10Quotation.rtf
windows10-2004-x64
1e1cf593726...1b.exe
windows7-x64
10e1cf593726...1b.exe
windows10-2004-x64
10macintosh.xlsx
windows7-x64
10macintosh.xlsx
windows10-2004-x64
1Resubmissions
01-02-2023 17:02
230201-vj6p3aah39 1001-02-2023 17:00
230201-vjf5eacg4s 1001-02-2023 16:57
230201-vgbrxacg2y 10Analysis
-
max time kernel
143s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 17:00
Behavioral task
behavioral1
Sample
0014c57bfd62d2929bbad91d67b77c3b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0014c57bfd62d2929bbad91d67b77c3b.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
660e3fcc23c3a833e6e8af22b13ebd81.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
660e3fcc23c3a833e6e8af22b13ebd81.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
9dc5600bedda76a29aa0e33da951fc30.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
9dc5600bedda76a29aa0e33da951fc30.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
Acwpn.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Acwpn.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
DHL SHIPPING DOC PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
DHL SHIPPING DOC PDF.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Halkbank_Ekstre_20230129_075423_612150o.pdf..exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Halkbank_Ekstre_20230129_075423_612150o.pdf..exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
INVOICEXANDXBANKXDETAILS.rtf
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
INVOICEXANDXBANKXDETAILS.rtf
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Maersk Shipping Docs.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Maersk Shipping Docs.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
ORDER INQUIRY 20230201.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
ORDER INQUIRY 20230201.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
PO-8372929.xls
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
PO-8372929.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
QUOTATION 1.rtf
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
QUOTATION 1.rtf
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Quotation.rtf
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Quotation.rtf
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
e1cf59372694c7d46d84d0139b40d41b.exe
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
e1cf59372694c7d46d84d0139b40d41b.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
macintosh.xlsx
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
macintosh.xlsx
Resource
win10v2004-20220812-en
General
-
Target
Maersk Shipping Docs.exe
-
Size
618KB
-
MD5
44d5f28d8c991060173cb3656c41c5f8
-
SHA1
a84aae8b5f67d315ce5a38ad09ddef4400dbc0b4
-
SHA256
f9aa33269f7d56d6a16db1c91b5ce0df11fbe25c50d2c3f2222e07b83098d212
-
SHA512
55bd716b64c97da1b4dde39e7b0da03703ced82733a1cf6a6e33a236c2c66a3462bad1dba2218591e835a0d541d054b4e180b412b59493d7c660ddf420277d3b
-
SSDEEP
12288:BmsaDf3H2cE2pmlWmYwaiwHliNj6Weh3ih9HnA:BWWmcZs80BYTA
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.wilcon.com.ph - Port:
587 - Username:
headcashier.alabang@wilcon.com.ph - Password:
password@cashier - Email To:
p4perlord@yandex.com
https://api.telegram.org/bot5839027687:AAGrC4UWgd0JQxMHOf1dCehA-oSrYF_Bez8/sendMessage?chat_id=1094077450
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral16/memory/1672-142-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Maersk Shipping Docs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation Maersk Shipping Docs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Maersk Shipping Docs.exedescription pid process target process PID 5044 set thread context of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3240 1672 WerFault.exe Maersk Shipping Docs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Maersk Shipping Docs.exepowershell.exeMaersk Shipping Docs.exepid process 5044 Maersk Shipping Docs.exe 5044 Maersk Shipping Docs.exe 3964 powershell.exe 1672 Maersk Shipping Docs.exe 3964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Maersk Shipping Docs.exepowershell.exeMaersk Shipping Docs.exedescription pid process Token: SeDebugPrivilege 5044 Maersk Shipping Docs.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeDebugPrivilege 1672 Maersk Shipping Docs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Maersk Shipping Docs.exedescription pid process target process PID 5044 wrote to memory of 3964 5044 Maersk Shipping Docs.exe powershell.exe PID 5044 wrote to memory of 3964 5044 Maersk Shipping Docs.exe powershell.exe PID 5044 wrote to memory of 3964 5044 Maersk Shipping Docs.exe powershell.exe PID 5044 wrote to memory of 1160 5044 Maersk Shipping Docs.exe schtasks.exe PID 5044 wrote to memory of 1160 5044 Maersk Shipping Docs.exe schtasks.exe PID 5044 wrote to memory of 1160 5044 Maersk Shipping Docs.exe schtasks.exe PID 5044 wrote to memory of 1528 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1528 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1528 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe PID 5044 wrote to memory of 1672 5044 Maersk Shipping Docs.exe Maersk Shipping Docs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\laYtZHUX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\laYtZHUX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD60.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"C:\Users\Admin\AppData\Local\Temp\Maersk Shipping Docs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 15403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1672 -ip 16721⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Maersk Shipping Docs.exe.logFilesize
1KB
MD5e50d61d6d5cec0d2c6b3fbf02b17af2d
SHA1fcf43f96e7389c27ee201fb00b65db01ca2cee40
SHA256a87cf2dbf70a59d3d347f9ca743b6ceb3c805b4714cf4fb963c18b9ca8ffd0a9
SHA5120348b60095cd48d275a5234fe34c1fd7a7c9921e1d92dafea0379d607f898eb1c2e089dafa1db608fad65497fc8f90fa699109b06a5f2c12c0bc8c9192ff9924
-
C:\Users\Admin\AppData\Local\Temp\tmpFD60.tmpFilesize
1KB
MD5150cd3c6fcecf735d811877750eaf652
SHA16651269ea421275184ba9acbbe060ca0d9a931fc
SHA256e2a3e2305668af6fe74d9ef1cf7d87a5b1abd8bf95e2324433ade3797db1c414
SHA512bce4ba0411047023bb98b5853771800ab5f8fb9f283f6afe1229911ecdf329814da57b022c8854b4327e3c20a31c71a918a074dbe80fa78e6d5bc6ec7d088ef1
-
memory/1160-136-0x0000000000000000-mapping.dmp
-
memory/1528-139-0x0000000000000000-mapping.dmp
-
memory/1672-145-0x0000000005BB0000-0x0000000006154000-memory.dmpFilesize
5.6MB
-
memory/1672-142-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1672-141-0x0000000000000000-mapping.dmp
-
memory/3964-144-0x00000000059F0000-0x0000000005A12000-memory.dmpFilesize
136KB
-
memory/3964-152-0x0000000008200000-0x000000000887A000-memory.dmpFilesize
6.5MB
-
memory/3964-137-0x0000000002FB0000-0x0000000002FE6000-memory.dmpFilesize
216KB
-
memory/3964-135-0x0000000000000000-mapping.dmp
-
memory/3964-158-0x0000000007ED0000-0x0000000007ED8000-memory.dmpFilesize
32KB
-
memory/3964-157-0x0000000007EF0000-0x0000000007F0A000-memory.dmpFilesize
104KB
-
memory/3964-156-0x0000000007DE0000-0x0000000007DEE000-memory.dmpFilesize
56KB
-
memory/3964-147-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/3964-146-0x0000000005B90000-0x0000000005BF6000-memory.dmpFilesize
408KB
-
memory/3964-148-0x00000000068B0000-0x00000000068CE000-memory.dmpFilesize
120KB
-
memory/3964-149-0x0000000006E80000-0x0000000006EB2000-memory.dmpFilesize
200KB
-
memory/3964-150-0x0000000071B20000-0x0000000071B6C000-memory.dmpFilesize
304KB
-
memory/3964-151-0x0000000006E60000-0x0000000006E7E000-memory.dmpFilesize
120KB
-
memory/3964-140-0x0000000005CC0000-0x00000000062E8000-memory.dmpFilesize
6.2MB
-
memory/3964-153-0x0000000007BB0000-0x0000000007BCA000-memory.dmpFilesize
104KB
-
memory/3964-154-0x0000000007C20000-0x0000000007C2A000-memory.dmpFilesize
40KB
-
memory/3964-155-0x0000000007E30000-0x0000000007EC6000-memory.dmpFilesize
600KB
-
memory/5044-133-0x0000000004F50000-0x0000000004FE2000-memory.dmpFilesize
584KB
-
memory/5044-132-0x00000000003B0000-0x0000000000450000-memory.dmpFilesize
640KB
-
memory/5044-134-0x0000000005290000-0x000000000532C000-memory.dmpFilesize
624KB