Analysis

  • max time kernel
    65s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/05/2023, 20:59

General

  • Target

    swiftremittance.exe

  • Size

    1.1MB

  • MD5

    7e542232ec05321a7d1f1a0eb6597b11

  • SHA1

    6fe1c3516e286efc108d0dca2f31290e779e753a

  • SHA256

    586153476e8cae5ad225cc3e1e033357e2ba4bc75f30bd7923afddc21c96b0da

  • SHA512

    6b0fc70891057513471ecf490738dd36ff2d45281b8f910730a28f9d1e41f8455d1515762b2bc6eb57aef2c313716a72b7b8dfb00770d8bdac6892911768c6bb

  • SSDEEP

    24576:NTbBv5rUan8Pr1yqBYB6UXmmNxrndGryTBZX:HBjWr0VBBXVdGoBZX

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1628683147:AAHrCQLe6jCIHNtCV4vrDvX8lcHsoz9HNAA/sendMessage?chat_id=917280008

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 4 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\swiftremittance.exe
    "C:\Users\Admin\AppData\Local\Temp\swiftremittance.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" Update-xq.d.vbe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\jtoh\resfuhiqr.pif
        "C:\Users\Admin\AppData\Local\Temp\jtoh\resfuhiqr.pif" jsucf.icm
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          4⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1864

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\jtoh\Update-xq.d.vbe

          Filesize

          67KB

          MD5

          743186e2e46af964d096e5d2d40247b5

          SHA1

          7fded1da804f83f9f51c9f232631b09bab92e73e

          SHA256

          0099c0836a5fc46336620114aba4420ccaa69dc2c56e4105e9721709c39fe6ab

          SHA512

          8c6b22afa2dbbc90608ea6e2fe5640e8e8016080e6a6496f2b2233e67e33f2fd5b1f79ee9de30948385d6862b8a9d694ee3a9f7e62148fa647eb09dc9bd2317e

        • C:\Users\Admin\AppData\Local\Temp\jtoh\cdpdpuexs.bin

          Filesize

          38KB

          MD5

          75b87ae9c3b5d2c986183f0d38007ac3

          SHA1

          263954040985fcef2c3f3186745590d9fbac633f

          SHA256

          3e85737ab64e22b1f0681d5cc42de62726d481cee496e4258c13a99ce7c84ec4

          SHA512

          61069b666b3c2660933fc9bd37e14024213a8978a1e015bb0436801bec0a95325ed194fb0c2a20d5dad7ccdef12d84d21273f63bd8afbdf683316054b3801667

        • C:\Users\Admin\AppData\Local\Temp\jtoh\jsucf.icm

          Filesize

          95.6MB

          MD5

          96540b9a1157f012a74526d438d24cbe

          SHA1

          bd9b5579d0ff3d1ec81c0ccfb408c89cf9ab9abc

          SHA256

          55d10a38268b28a067f3e55d110ed58e0574133928732ede76fb35878715cec9

          SHA512

          5f717fb76af9aa0d9a2822fc304be644127333060212d6d54b49c28c8c1605e3dd71d825cd0b3d50071928ff65b38d0bfc1dddf73231bce426ce6900173256c1

        • C:\Users\Admin\AppData\Local\Temp\jtoh\resfuhiqr.pif

          Filesize

          1.2MB

          MD5

          d08467871656edc79c1dfe974d91c450

          SHA1

          226105367ba3663becdde32280b1714fdcacebcb

          SHA256

          0323b0cbc6726d09c091163fa80885b93d91ece8394cbad0bb87e4e38a756798

          SHA512

          fcb659bd06031e6b3b3b0c03620aeb8a526c6eae6f17db717dd4703a3edc98e8392a5e8118c47db52933c05e2f8fe0cc3eb747f85ff0f0a910bf6142ccbb2fa7

        • C:\Users\Admin\AppData\Local\Temp\jtoh\resfuhiqr.pif

          Filesize

          1.2MB

          MD5

          d08467871656edc79c1dfe974d91c450

          SHA1

          226105367ba3663becdde32280b1714fdcacebcb

          SHA256

          0323b0cbc6726d09c091163fa80885b93d91ece8394cbad0bb87e4e38a756798

          SHA512

          fcb659bd06031e6b3b3b0c03620aeb8a526c6eae6f17db717dd4703a3edc98e8392a5e8118c47db52933c05e2f8fe0cc3eb747f85ff0f0a910bf6142ccbb2fa7

        • C:\Users\Admin\AppData\Local\Temp\jtoh\uvkbapqr.mnd

          Filesize

          218KB

          MD5

          299a8961aadeb97da2e90ea58eff7909

          SHA1

          52a3201d09b853250cae1beb26c7dc14456f3cc6

          SHA256

          03a35f43c89f967387006eaaacfcb7411ad698268bc7b1c9a56b2f6b0d4c30d9

          SHA512

          d26359612c6cda72961a9769363aa94b310bc56099e3680dab3a521db17201935df8603c3199ce76db553877a937863de53d8cbbb4e792b1da52ab50a16143c5

        • \Users\Admin\AppData\Local\Temp\jtoh\resfuhiqr.pif

          Filesize

          1.2MB

          MD5

          d08467871656edc79c1dfe974d91c450

          SHA1

          226105367ba3663becdde32280b1714fdcacebcb

          SHA256

          0323b0cbc6726d09c091163fa80885b93d91ece8394cbad0bb87e4e38a756798

          SHA512

          fcb659bd06031e6b3b3b0c03620aeb8a526c6eae6f17db717dd4703a3edc98e8392a5e8118c47db52933c05e2f8fe0cc3eb747f85ff0f0a910bf6142ccbb2fa7

        • memory/1864-213-0x0000000000240000-0x0000000000824000-memory.dmp

          Filesize

          5.9MB

        • memory/1864-214-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1864-215-0x0000000000240000-0x0000000000824000-memory.dmp

          Filesize

          5.9MB

        • memory/1864-217-0x0000000000240000-0x0000000000824000-memory.dmp

          Filesize

          5.9MB

        • memory/1864-219-0x0000000000240000-0x0000000000824000-memory.dmp

          Filesize

          5.9MB

        • memory/1864-220-0x0000000000240000-0x0000000000266000-memory.dmp

          Filesize

          152KB

        • memory/1864-221-0x00000000051A0000-0x00000000051E0000-memory.dmp

          Filesize

          256KB

        • memory/1864-222-0x00000000051A0000-0x00000000051E0000-memory.dmp

          Filesize

          256KB