Analysis
-
max time kernel
183s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2023, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe
Resource
win10v2004-20230220-en
General
-
Target
8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe
-
Size
708KB
-
MD5
4a2fb0d3859d4fb7cb6c97e0a6817584
-
SHA1
fbd0fa257ac8729fa149eb323853de20469dbbeb
-
SHA256
8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529
-
SHA512
fafca38175457b61dbbd72a02ab6d75172a94b2e5800f2eded4b8f623b5a4676ec796f7ed3dd1636e3b751df1f65424b4ec3e5f13e6e1fde51e35dff88f455ad
-
SSDEEP
12288:3DMq4fyMw8CJuuJ99fRKKGNDvgeFLtZexgQKxFUTWIEMW:CS9WKGkehQquT
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5799835476:AAFiZfeIZu-7ZRuBqclPng8ud3yXZLUXpw8/sendMessage?chat_id=5666881718
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/3912-144-0x0000000000400000-0x000000000042A000-memory.dmp family_snakekeylogger -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/3912-144-0x0000000000400000-0x000000000042A000-memory.dmp family_stormkitty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 68 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4948 set thread context of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3832 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 3912 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 3912 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe Token: SeDebugPrivilege 3912 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4948 wrote to memory of 3832 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 88 PID 4948 wrote to memory of 3832 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 88 PID 4948 wrote to memory of 3832 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 88 PID 4948 wrote to memory of 560 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 90 PID 4948 wrote to memory of 560 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 90 PID 4948 wrote to memory of 560 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 90 PID 4948 wrote to memory of 1996 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 91 PID 4948 wrote to memory of 1996 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 91 PID 4948 wrote to memory of 1996 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 91 PID 4948 wrote to memory of 2328 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 92 PID 4948 wrote to memory of 2328 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 92 PID 4948 wrote to memory of 2328 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 92 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 PID 4948 wrote to memory of 3912 4948 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe 93 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe"C:\Users\Admin\AppData\Local\Temp\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QFCLcta" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4793.tmp"2⤵
- Creates scheduled task(s)
PID:3832
-
-
C:\Users\Admin\AppData\Local\Temp\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe"{path}"2⤵PID:560
-
-
C:\Users\Admin\AppData\Local\Temp\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe"{path}"2⤵PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe"{path}"2⤵PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3912
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8e2b4ef3690596ac262df39667fbc2c9cdd5870a1215fd43e1075261a5dfc529.exe.log
Filesize1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
Filesize
1KB
MD5ca8f85a8fbb170a3b98ded55b6c0c1b1
SHA1e33419caaae5b7ad92930b7c8fb831f8f311b73e
SHA256332cbdd4061728a73fbcddf452c3599f56232f8aa8a7a9b9380ac52e654a608e
SHA512c74841e7d66151db0ba0edecef50979a372284d241a5ef35fb2771cb1b88a248cb0f6ac0febadfaff1852e11562191d90a5cfae51a850c8e86cf2dd9dfea92bf