Overview

overview

10

Static

static

1

TT return ...df.exe

windows7-x64

10

TT return ...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 06:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TT return copy .pdf.exe

  • Size

    1.0MB

  • MD5

    10d17b5b38280ae719f8e8d9bb68422b

  • SHA1

    5679dc8fcbd8f4bae164494e361590d52f04d431

  • SHA256

    0312ca773d06b41b2906310879143c0737bb66dbfda5d01ec1ec69d4cfb58adc

  • SHA512

    8bd099546edf4910010966821afdfdbe41f8f2dd41a501fa65cfd56799380639f9329614fcb9dfd5e4d6800e1db6564ed9c78623b94082100cee663d72fb3f22

  • SSDEEP

    24576:EwrVZ96e5wbe71SW3dslTfhdVWq2FS2qef2:D3Tse77CTPVEFS2

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5302690346:AAHm8HQofEvDG4ubNtPRHLfVIUU5VWSx970/sendMessage?chat_id=1673719962

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe"
      2⤵
        PID:4876
      • C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe"
        2⤵
          PID:4008
        • C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\TT return copy .pdf.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3952
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1500
            3⤵
            • Program crash
            PID:2804
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3952 -ip 3952
        1⤵
          PID:1296

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TT return copy .pdf.exe.log
          Filesize

          1KB

          MD5

          b7b9acb869ccc7f7ecb5304ec0384dee

          SHA1

          6a90751c95817903ee833d59a0abbef425a613b3

          SHA256

          8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

          SHA512

          7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

          Download Submit
        • memory/3928-133-0x0000000000460000-0x000000000056A000-memory.dmp
          Filesize

          1.0MB

          Download
        • memory/3928-134-0x0000000005540000-0x0000000005AE4000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/3928-135-0x0000000004EE0000-0x0000000004F72000-memory.dmp
          Filesize

          584KB

          Download
        • memory/3928-136-0x0000000005430000-0x000000000543A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/3928-137-0x0000000004E70000-0x0000000004E80000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3928-138-0x0000000004E70000-0x0000000004E80000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3928-139-0x0000000007430000-0x00000000074CC000-memory.dmp
          Filesize

          624KB

          Download
        • memory/3952-140-0x0000000000400000-0x0000000000426000-memory.dmp
          Filesize

          152KB

          Download
        • memory/3952-143-0x0000000005990000-0x00000000059A0000-memory.dmp
          Filesize

          64KB

          Download