Analysis

  • max time kernel
    41s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2023, 08:24

General

  • Target

    08052023.exe

  • Size

    442KB

  • MD5

    085002173c9d09e515978b19b52e775c

  • SHA1

    f288270f7b2a6463c4e177e4f9d82a07a01c7867

  • SHA256

    e64d2225119a5860cb2d7a12914d0834d174a72d387e84b58e3d94c89aadbc58

  • SHA512

    14f5d7d535dbddd8868d48f07e892b5eccf81af4f3b5e6ecabedb3575f90e96276ff1a8e5f59a819d561a4277f0ee350f12ec800dd5d0604be4add3e9d89539e

  • SSDEEP

    6144:n4sL+pKQRtV4QMqHT9xjoOOCTJ3uWFQ+yi1apMc4uAvnhAp081nNVjqKoe:Sv8IF3uWFQ+D1apMcov6nnjqKoe

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6296181609:AAGAOhYH-dkTEQqHw-rWHbkpGOeR4Z7OA18/sendMessage?chat_id=1760125104

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 7 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08052023.exe
    "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Users\Admin\AppData\Local\Temp\08052023.exe
      "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
      2⤵
        PID:1388
      • C:\Users\Admin\AppData\Local\Temp\08052023.exe
        "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
        2⤵
          PID:1376
        • C:\Users\Admin\AppData\Local\Temp\08052023.exe
          "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
          2⤵
            PID:1484
          • C:\Users\Admin\AppData\Local\Temp\08052023.exe
            "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
            2⤵
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:1316

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/840-62-0x0000000004990000-0x00000000049D0000-memory.dmp

                Filesize

                256KB

              • memory/840-55-0x0000000000370000-0x00000000003A8000-memory.dmp

                Filesize

                224KB

              • memory/840-56-0x00000000003C0000-0x00000000003CA000-memory.dmp

                Filesize

                40KB

              • memory/840-54-0x00000000009A0000-0x0000000000A14000-memory.dmp

                Filesize

                464KB

              • memory/1316-57-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-59-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-58-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-60-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                Filesize

                4KB

              • memory/1316-63-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-65-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-67-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/1316-68-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

                Filesize

                256KB

              • memory/1316-69-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

                Filesize

                256KB