Analysis
-
max time kernel
54s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-02-2023 15:18
Static task
static1
Behavioral task
behavioral1
Sample
Uarngd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Uarngd.exe
Resource
win10v2004-20221111-en
General
-
Target
Uarngd.exe
-
Size
7KB
-
MD5
51b95537e2f88be4e97ca30fd565c6a2
-
SHA1
3c19c4f72b3737b8c365462b578e46a681990470
-
SHA256
3b6d60b69e3438ca5aaad8edf8b87f8c39f72803aa3c90a929aff5239d998333
-
SHA512
d177cfdbec6511d7fce4911b0e2b4d3581bb625d02df2ced2ab3cf774873cae1748f796fa939b269c1d0c267a63f89d82c51784c183c067cd9f9c6a0f89e9c39
-
SSDEEP
96:0+10kTSeg3MLEmVJsdtldCDxLGP8ZY7ZMtblNb6k2wImQgJtXstMtzNt:0+nWeg3SXJ45C5GPGldHbIfgzXEMH
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5497972920:AAHqqS9EfkxnwYz3pQtCWef33URevfy5tRk/sendMessage?chat_id=1653988628
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1316-143-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Uarngd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Uarngd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Uarngd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Uarngd.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Uarngd.exe Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Uarngd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Uarngd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fapkq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Icrqbdo\\Fapkq.exe\"" Uarngd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Uarngd.exedescription pid process target process PID 1976 set thread context of 1316 1976 Uarngd.exe Uarngd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeUarngd.exepid process 1972 powershell.exe 1972 powershell.exe 1316 Uarngd.exe 1316 Uarngd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Uarngd.exepowershell.exeUarngd.exedescription pid process Token: SeDebugPrivilege 1976 Uarngd.exe Token: SeDebugPrivilege 1972 powershell.exe Token: SeDebugPrivilege 1316 Uarngd.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Uarngd.exedescription pid process target process PID 1976 wrote to memory of 1972 1976 Uarngd.exe powershell.exe PID 1976 wrote to memory of 1972 1976 Uarngd.exe powershell.exe PID 1976 wrote to memory of 1972 1976 Uarngd.exe powershell.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe PID 1976 wrote to memory of 1316 1976 Uarngd.exe Uarngd.exe -
outlook_office_path 1 IoCs
Processes:
Uarngd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Uarngd.exe -
outlook_win_path 1 IoCs
Processes:
Uarngd.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Uarngd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uarngd.exe"C:\Users\Admin\AppData\Local\Temp\Uarngd.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Uarngd.exeC:\Users\Admin\AppData\Local\Temp\Uarngd.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Uarngd.exe.logFilesize
1KB
MD53a9188331a78f1dbce606db64b841fcb
SHA18e2c99b7c477d06591a856a4ea3e1e214719eee8
SHA256db4137e258a0f6159fda559a5f6dd2704be0582c3f0586f65040c7ad1eb68451
SHA512d1a994610a045d89d5d306866c24ae56bf16555414b8f63f632552568e67b5586f26d5a17a1f0a55ada376730298e6d856e9161828d4eae9decfa4e015e0e90a
-
memory/1316-142-0x0000000000000000-mapping.dmp
-
memory/1316-149-0x00000000069C0000-0x00000000069CA000-memory.dmpFilesize
40KB
-
memory/1316-148-0x00000000069E0000-0x0000000006A72000-memory.dmpFilesize
584KB
-
memory/1316-147-0x0000000006B00000-0x0000000006CC2000-memory.dmpFilesize
1.8MB
-
memory/1316-146-0x00000000057D0000-0x000000000586C000-memory.dmpFilesize
624KB
-
memory/1316-145-0x0000000005D80000-0x0000000006324000-memory.dmpFilesize
5.6MB
-
memory/1316-143-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1972-136-0x00000000054F0000-0x0000000005B18000-memory.dmpFilesize
6.2MB
-
memory/1972-141-0x0000000006790000-0x00000000067AA000-memory.dmpFilesize
104KB
-
memory/1972-140-0x0000000007AF0000-0x000000000816A000-memory.dmpFilesize
6.5MB
-
memory/1972-139-0x0000000006270000-0x000000000628E000-memory.dmpFilesize
120KB
-
memory/1972-138-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/1972-137-0x0000000005B90000-0x0000000005BF6000-memory.dmpFilesize
408KB
-
memory/1972-135-0x0000000002C80000-0x0000000002CB6000-memory.dmpFilesize
216KB
-
memory/1972-134-0x0000000000000000-mapping.dmp
-
memory/1976-132-0x00000000007A0000-0x00000000007A8000-memory.dmpFilesize
32KB
-
memory/1976-133-0x0000000006860000-0x0000000006882000-memory.dmpFilesize
136KB