Analysis

  • max time kernel
    142s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2023 08:41

General

  • Target

    c1c2c7f68cd6257da48226477b7be1b3d82b9f6ee7b1e421b7b9d5191f89c8c6.exe

  • Size

    159KB

  • MD5

    2c8ecd01029e296bf5c6b743e07bcc8d

  • SHA1

    98534bd6d5c08cf14734a63713d930e12f69c5f0

  • SHA256

    c1c2c7f68cd6257da48226477b7be1b3d82b9f6ee7b1e421b7b9d5191f89c8c6

  • SHA512

    983590ed6f4aacd9f80142b60f4f64627a2f639ccda9c32b3c6260caad10f0fd667cd0c5cc93dc26ace5c5c6b1a84b4e8a27623bba873bf15f81537e64889726

  • SSDEEP

    768:CM9Cr+M0fV7RW1JbUGmp7NxryR27zAFEzD/xworhF:CM92e7RAJu7vryR2XSWwOhF

Malware Config

Extracted

Family

purecrypter

C2

http://192.3.26.135/uo/Ksagb.png

Extracted

Family

snakekeylogger

Credentials

Signatures

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1c2c7f68cd6257da48226477b7be1b3d82b9f6ee7b1e421b7b9d5191f89c8c6.exe
    "C:\Users\Admin\AppData\Local\Temp\c1c2c7f68cd6257da48226477b7be1b3d82b9f6ee7b1e421b7b9d5191f89c8c6.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yz11dtz2.huj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/216-153-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/216-161-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/216-154-0x00000000065D0000-0x00000000065EE000-memory.dmp

    Filesize

    120KB

  • memory/216-160-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/216-155-0x0000000007C10000-0x000000000828A000-memory.dmp

    Filesize

    6.5MB

  • memory/216-139-0x0000000002FF0000-0x0000000003026000-memory.dmp

    Filesize

    216KB

  • memory/216-140-0x0000000005770000-0x0000000005D98000-memory.dmp

    Filesize

    6.2MB

  • memory/216-156-0x0000000006AD0000-0x0000000006AEA000-memory.dmp

    Filesize

    104KB

  • memory/216-159-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/216-147-0x0000000005FF0000-0x0000000006056000-memory.dmp

    Filesize

    408KB

  • memory/216-152-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/216-157-0x0000000005130000-0x0000000005140000-memory.dmp

    Filesize

    64KB

  • memory/216-141-0x0000000005F10000-0x0000000005F76000-memory.dmp

    Filesize

    408KB

  • memory/1472-138-0x0000000007700000-0x0000000007722000-memory.dmp

    Filesize

    136KB

  • memory/1472-136-0x00000000057E0000-0x00000000057EA000-memory.dmp

    Filesize

    40KB

  • memory/1472-133-0x0000000000E00000-0x0000000000E2E000-memory.dmp

    Filesize

    184KB

  • memory/1472-158-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

    Filesize

    64KB

  • memory/1472-134-0x0000000005D40000-0x00000000062E4000-memory.dmp

    Filesize

    5.6MB

  • memory/1472-137-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

    Filesize

    64KB

  • memory/1472-135-0x0000000005830000-0x00000000058C2000-memory.dmp

    Filesize

    584KB

  • memory/1860-166-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1860-168-0x00000000050C0000-0x000000000515C000-memory.dmp

    Filesize

    624KB

  • memory/1860-169-0x0000000005420000-0x0000000005430000-memory.dmp

    Filesize

    64KB

  • memory/1860-170-0x0000000006170000-0x0000000006332000-memory.dmp

    Filesize

    1.8MB

  • memory/1860-171-0x0000000005420000-0x0000000005430000-memory.dmp

    Filesize

    64KB