Analysis

  • max time kernel
    151s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2023 19:19

General

  • Target

    SMGS.exe

  • Size

    4.8MB

  • MD5

    973d6bb15efd90c87c861bb50682b4e0

  • SHA1

    6be806023c19d7b332118bdc60ec2cabf4afd7a7

  • SHA256

    464bf35525b6f482b91e5a1ba287c58304e7c41558c8070e42bdaa19769b5b05

  • SHA512

    02355d9053c02c7470cdf6bde0a7d30ddf8a15a98c70dedf67a44639db3f92f1f961cb887e262b91eaeaeeef406e83c1294c690165afe2d7b50bae2e13896237

  • SSDEEP

    24576:VBgHFLM9d5M7WbzMdMp+5R6hIONsEQ/xWxPNnb1T/d+BIPFsKmQhhEG6veOSV1jF:

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SMGS.exe
    "C:\Users\Admin\AppData\Local\Temp\SMGS.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4484
    • C:\Users\Admin\AppData\Local\Temp\SMGS.exe
      C:\Users\Admin\AppData\Local\Temp\SMGS.exe
      2⤵
        PID:4720
      • C:\Users\Admin\AppData\Local\Temp\SMGS.exe
        C:\Users\Admin\AppData\Local\Temp\SMGS.exe
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2840

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    3
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    3
    T1005

    Email Collection

    1
    T1114

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SMGS.exe.log
      Filesize

      1KB

      MD5

      a713c363be116d5ed1f971db6a657e4f

      SHA1

      90791863564c9ed38e7b4f047022dec4474060a1

      SHA256

      4b5c446ec8ed2a2696ba00a0890763d413006ce1ea1a7a32fda1655720aef46e

      SHA512

      5dc740414a6ec30908e924f3bdfae2f761a35a476ef2dda239b789575a0a3696169deb6dc84a14d5828eaa5644623f107b2c686bfa4f54a90f0688239b4b1739

    • memory/2732-133-0x0000000006A60000-0x0000000006A82000-memory.dmp
      Filesize

      136KB

    • memory/2732-132-0x0000000000790000-0x0000000000C58000-memory.dmp
      Filesize

      4.8MB

    • memory/2840-143-0x0000000000000000-mapping.dmp
    • memory/2840-150-0x0000000006910000-0x000000000691A000-memory.dmp
      Filesize

      40KB

    • memory/2840-149-0x0000000006B10000-0x0000000006BA2000-memory.dmp
      Filesize

      584KB

    • memory/2840-148-0x0000000006940000-0x0000000006B02000-memory.dmp
      Filesize

      1.8MB

    • memory/2840-147-0x0000000005670000-0x000000000570C000-memory.dmp
      Filesize

      624KB

    • memory/2840-146-0x0000000005C20000-0x00000000061C4000-memory.dmp
      Filesize

      5.6MB

    • memory/2840-144-0x0000000000400000-0x0000000000426000-memory.dmp
      Filesize

      152KB

    • memory/4484-136-0x0000000005250000-0x0000000005878000-memory.dmp
      Filesize

      6.2MB

    • memory/4484-141-0x0000000006480000-0x000000000649A000-memory.dmp
      Filesize

      104KB

    • memory/4484-140-0x0000000007870000-0x0000000007EEA000-memory.dmp
      Filesize

      6.5MB

    • memory/4484-139-0x0000000005F90000-0x0000000005FAE000-memory.dmp
      Filesize

      120KB

    • memory/4484-138-0x0000000005A00000-0x0000000005A66000-memory.dmp
      Filesize

      408KB

    • memory/4484-137-0x0000000005920000-0x0000000005986000-memory.dmp
      Filesize

      408KB

    • memory/4484-135-0x0000000002650000-0x0000000002686000-memory.dmp
      Filesize

      216KB

    • memory/4484-134-0x0000000000000000-mapping.dmp
    • memory/4720-142-0x0000000000000000-mapping.dmp