Analysis
- max time kernel
100s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
28/04/2023, 04:37
General
- Target Payment Advice.exe
- Size 1.4MB
- Sample230428-e8sxhabg97
- SHA256 886a8581f310f5d4244c1f263a9e2bbc2d759bcc8078351990bf7ab2f1c1e717
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot5816308075:AAFAHgyFsBJDNSX2LHn4UAAqe1sHrGMznc4/sendMessage?chat_id=5857548246
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- StormKitty
StormKitty is an open source info stealer written in C#.
- StormKitty payload 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2228-137-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2228-139-0x00000000058C0000-0x0000000005E64000-memory.dmp
memory/2228-140-0x0000000005400000-0x000000000549C000-memory.dmp
memory/2228-141-0x0000000005640000-0x0000000005650000-memory.dmp
memory/2228-142-0x0000000005640000-0x0000000005650000-memory.dmp
memory/2228-143-0x00000000067D0000-0x0000000006862000-memory.dmp
memory/2228-144-0x00000000067A0000-0x00000000067AA000-memory.dmp
memory/2880-133-0x0000000000220000-0x000000000038E000-memory.dmp
memory/2880-134-0x00000000061B0000-0x00000000061D2000-memory.dmp
memory/2880-135-0x0000000004D80000-0x0000000004D90000-memory.dmp