Analysis
-
max time kernel
63s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 06:14
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20230220-en
General
-
Target
Purchase Order.exe
-
Size
754KB
-
MD5
618bcea5b2abf922de2e342ce0714378
-
SHA1
ae73bf3a57ba8f081ae2d37ae903d073772bd48e
-
SHA256
3d31416fc1abd53a89b8e7f61a3a4a392be2c1a2a8947562a58504b9e6300be0
-
SHA512
3f0de2fef6e4ae8a0e3f3f8714065e21da32924cf94d5516b2bcee26b32b8d4c711d6d84b2361500977330022d134ea4f42af2bd4d1426421d5cc1a878f793eb
-
SSDEEP
12288:D3fKdJVZz5dz9sWJxt0kq4WVJXo7WUZmxLY4WDPr9vfquA5JcqAVC4SrMLkCL1S:DMVZ9824AiXqbsdWDP5nzAXhAURikCLs
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6028065759:AAGXMc8NHPy2_lXiMVsOvq8DgefjK4ifT-U/sendMessage?chat_id=5069697890
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1500-63-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1500-64-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1500-66-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1500-68-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1500-70-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1500-71-0x0000000000680000-0x00000000006C0000-memory.dmp family_snakekeylogger behavioral1/memory/1500-72-0x0000000000680000-0x00000000006C0000-memory.dmp family_snakekeylogger -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Purchase Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 1308 set thread context of 1500 1308 Purchase Order.exe Purchase Order.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Purchase Order.exepid process 1500 Purchase Order.exe 1500 Purchase Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Purchase Order.exedescription pid process Token: SeDebugPrivilege 1500 Purchase Order.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe PID 1308 wrote to memory of 1500 1308 Purchase Order.exe Purchase Order.exe -
outlook_office_path 1 IoCs
Processes:
Purchase Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe -
outlook_win_path 1 IoCs
Processes:
Purchase Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-54-0x0000000000EE0000-0x0000000000FA2000-memory.dmpFilesize
776KB
-
memory/1308-55-0x0000000000A00000-0x0000000000A40000-memory.dmpFilesize
256KB
-
memory/1308-56-0x0000000000770000-0x0000000000790000-memory.dmpFilesize
128KB
-
memory/1308-57-0x0000000000A00000-0x0000000000A40000-memory.dmpFilesize
256KB
-
memory/1308-58-0x0000000000790000-0x000000000079C000-memory.dmpFilesize
48KB
-
memory/1308-59-0x0000000005410000-0x00000000054B2000-memory.dmpFilesize
648KB
-
memory/1308-60-0x0000000000AA0000-0x0000000000AC8000-memory.dmpFilesize
160KB
-
memory/1500-61-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-62-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-63-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-64-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1500-66-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-68-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-70-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1500-71-0x0000000000680000-0x00000000006C0000-memory.dmpFilesize
256KB
-
memory/1500-72-0x0000000000680000-0x00000000006C0000-memory.dmpFilesize
256KB