Analysis

  • max time kernel
    245s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2023, 20:42

General

  • Target

    GeneralAttachment.exe

  • Size

    577KB

  • MD5

    f84c0765285cfa761e31bfa7f5f2b878

  • SHA1

    5ef22c3d8dc871cb6a7b1c786db00ab558c64a97

  • SHA256

    37617e571066d7e620392e8be59f962ae9c20dade410e7291b345bf669b0c59d

  • SHA512

    7475d3467ecc6e5ca8597cfc797a9d52de808d9f4ca6e8645ec561336300c0843266cad33db5dd54e01bbbece0fbd7d090ed6b06a7b176c295ff26fc6ee7f827

  • SSDEEP

    12288:34awZIJA5PDeLQM7SEUdnX+z3eSvDBKFtI0JrxwS:ygkDT2wnXQ7F0dxd

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 6 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GeneralAttachment.exe
    "C:\Users\Admin\AppData\Local\Temp\GeneralAttachment.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cvltQgKHOkpV.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:988
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cvltQgKHOkpV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:792
    • C:\Users\Admin\AppData\Local\Temp\GeneralAttachment.exe
      "C:\Users\Admin\AppData\Local\Temp\GeneralAttachment.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1524

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpAFE0.tmp

          Filesize

          1KB

          MD5

          ad941b8069167ace733e10f7615787f2

          SHA1

          025ad39d9ea4770aec5691671556df7e6d08a7fd

          SHA256

          2a179bbac56b71d1cb40d2c87d9e60892b5583d0f9d973cf2f3bf30ec304253b

          SHA512

          80107b93304786ae929178b2806ec8701a42f1da6af5cdc207683fdfb35b809bf65241b0d380d94918f6b4cdc1a3a80df90d3269d9b57f24833edd27604f656f

        • memory/268-54-0x0000000001380000-0x0000000001416000-memory.dmp

          Filesize

          600KB

        • memory/268-55-0x0000000001280000-0x00000000012C0000-memory.dmp

          Filesize

          256KB

        • memory/268-56-0x00000000003D0000-0x00000000003E6000-memory.dmp

          Filesize

          88KB

        • memory/268-57-0x0000000001280000-0x00000000012C0000-memory.dmp

          Filesize

          256KB

        • memory/268-58-0x00000000003F0000-0x00000000003FC000-memory.dmp

          Filesize

          48KB

        • memory/268-59-0x000000000A210000-0x000000000A272000-memory.dmp

          Filesize

          392KB

        • memory/268-74-0x0000000000540000-0x0000000000568000-memory.dmp

          Filesize

          160KB

        • memory/988-71-0x0000000002480000-0x00000000024C0000-memory.dmp

          Filesize

          256KB

        • memory/988-69-0x0000000002480000-0x00000000024C0000-memory.dmp

          Filesize

          256KB

        • memory/988-68-0x0000000002480000-0x00000000024C0000-memory.dmp

          Filesize

          256KB

        • memory/988-72-0x0000000002480000-0x00000000024C0000-memory.dmp

          Filesize

          256KB

        • memory/988-73-0x0000000002480000-0x00000000024C0000-memory.dmp

          Filesize

          256KB

        • memory/988-67-0x0000000002480000-0x00000000024C0000-memory.dmp

          Filesize

          256KB

        • memory/1524-76-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-75-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-77-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-78-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-79-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1524-80-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-82-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-84-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1524-85-0x0000000000560000-0x00000000005A0000-memory.dmp

          Filesize

          256KB