Analysis
-
max time kernel
100s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 06:14
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v2004-20230220-en
General
-
Target
Purchase Order.exe
-
Size
754KB
-
MD5
618bcea5b2abf922de2e342ce0714378
-
SHA1
ae73bf3a57ba8f081ae2d37ae903d073772bd48e
-
SHA256
3d31416fc1abd53a89b8e7f61a3a4a392be2c1a2a8947562a58504b9e6300be0
-
SHA512
3f0de2fef6e4ae8a0e3f3f8714065e21da32924cf94d5516b2bcee26b32b8d4c711d6d84b2361500977330022d134ea4f42af2bd4d1426421d5cc1a878f793eb
-
SSDEEP
12288:D3fKdJVZz5dz9sWJxt0kq4WVJXo7WUZmxLY4WDPr9vfquA5JcqAVC4SrMLkCL1S:DMVZ9824AiXqbsdWDP5nzAXhAURikCLs
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6028065759:AAGXMc8NHPy2_lXiMVsOvq8DgefjK4ifT-U/sendMessage?chat_id=5069697890
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2848-140-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral2/memory/2848-145-0x00000000054C0000-0x00000000054D0000-memory.dmp family_snakekeylogger -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Purchase Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 31 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 3516 set thread context of 2848 3516 Purchase Order.exe Purchase Order.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Purchase Order.exepid process 2848 Purchase Order.exe 2848 Purchase Order.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Purchase Order.exedescription pid process Token: SeDebugPrivilege 2848 Purchase Order.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe PID 3516 wrote to memory of 2848 3516 Purchase Order.exe Purchase Order.exe -
outlook_office_path 1 IoCs
Processes:
Purchase Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe -
outlook_win_path 1 IoCs
Processes:
Purchase Order.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Purchase Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.logFilesize
1KB
MD5b7b9acb869ccc7f7ecb5304ec0384dee
SHA16a90751c95817903ee833d59a0abbef425a613b3
SHA2568cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4
SHA5127bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764
-
memory/2848-140-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2848-143-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/2848-144-0x00000000065C0000-0x0000000006782000-memory.dmpFilesize
1.8MB
-
memory/2848-145-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/3516-133-0x0000000000CC0000-0x0000000000D82000-memory.dmpFilesize
776KB
-
memory/3516-134-0x0000000005C70000-0x0000000006214000-memory.dmpFilesize
5.6MB
-
memory/3516-135-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/3516-136-0x0000000005900000-0x000000000590A000-memory.dmpFilesize
40KB
-
memory/3516-137-0x0000000005990000-0x00000000059A0000-memory.dmpFilesize
64KB
-
memory/3516-138-0x0000000005990000-0x00000000059A0000-memory.dmpFilesize
64KB
-
memory/3516-139-0x0000000007C20000-0x0000000007CBC000-memory.dmpFilesize
624KB