Analysis
-
max time kernel
72s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2023, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
Payment Details PDF.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment Details PDF.exe
Resource
win10v2004-20230220-en
General
-
Target
Payment Details PDF.exe
-
Size
584KB
-
MD5
81bf7194541beae3d3878600b63e5753
-
SHA1
67ce7c1ace75ee46b8ce83feedaef37c1f0a59a2
-
SHA256
201a70eaa336c001f0573d3a2915e2c372df418bbf27c8729b30e4b08da2e8c9
-
SHA512
09b0a2ec5ce3ffac0705cf27973da0a26ed45eaef2893dc25fdc43b102219f0bbc768d50ac8ca5fdfac32af1cf5777bf74e6bd72a4543baa1bd2fd607473f4ee
-
SSDEEP
6144:LMZIXrvWfZJpKtHrnI9Dw17I+Ic5T1LxHE8CZV8m+oNRJOO2jRq2E71lOWMqp7t/:e+nIm7I+TRVCEm+oX52RIxlH7tUFu
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5435719278:AAFkA_rGsUomupSCBqIPHcOBw0iPF0KuOG0/sendMessage?chat_id=5666881718
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 7 IoCs
resource yara_rule behavioral1/memory/568-65-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/568-66-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/568-68-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/568-70-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/568-72-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/568-73-0x00000000049A0000-0x00000000049E0000-memory.dmp family_snakekeylogger behavioral1/memory/568-74-0x00000000049A0000-0x00000000049E0000-memory.dmp family_snakekeylogger -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 6 IoCs
resource yara_rule behavioral1/memory/568-65-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/568-66-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/568-68-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/568-70-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/568-72-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/568-74-0x00000000049A0000-0x00000000049E0000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment Details PDF.exe Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment Details PDF.exe Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment Details PDF.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1960 set thread context of 568 1960 Payment Details PDF.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 268 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 568 Payment Details PDF.exe 568 Payment Details PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 568 Payment Details PDF.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1960 wrote to memory of 268 1960 Payment Details PDF.exe 27 PID 1960 wrote to memory of 268 1960 Payment Details PDF.exe 27 PID 1960 wrote to memory of 268 1960 Payment Details PDF.exe 27 PID 1960 wrote to memory of 268 1960 Payment Details PDF.exe 27 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 PID 1960 wrote to memory of 568 1960 Payment Details PDF.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment Details PDF.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Payment Details PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JSkmEG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE8F.tmp"2⤵
- Creates scheduled task(s)
PID:268
-
-
C:\Users\Admin\AppData\Local\Temp\Payment Details PDF.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:568
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56b7793e8871108034653dddbfe160e57
SHA1fe9bf05bf4a12184ea7cd831791359334824f5f7
SHA256e1ac77f2cf87df20f73fc65e2ba5682b42f6b5402026a3cc765f854e7789d982
SHA512936ae56074fc69b7fa807511627dcd7d752fb0f049538f3a01b25ea4d15ba065834f0c0cbe05364c47e59dcddf9bd1fb2c9c5ebffb75e9e4bc21c593381a7b1e