Analysis
-
max time kernel
41s -
max time network
112s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/05/2023, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
08052023.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
08052023.exe
Resource
win10v2004-20230220-en
General
-
Target
08052023.exe
-
Size
442KB
-
MD5
085002173c9d09e515978b19b52e775c
-
SHA1
f288270f7b2a6463c4e177e4f9d82a07a01c7867
-
SHA256
e64d2225119a5860cb2d7a12914d0834d174a72d387e84b58e3d94c89aadbc58
-
SHA512
14f5d7d535dbddd8868d48f07e892b5eccf81af4f3b5e6ecabedb3575f90e96276ff1a8e5f59a819d561a4277f0ee350f12ec800dd5d0604be4add3e9d89539e
-
SSDEEP
6144:n4sL+pKQRtV4QMqHT9xjoOOCTJ3uWFQ+yi1apMc4uAvnhAp081nNVjqKoe:Sv8IF3uWFQ+D1apMcov6nnjqKoe
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6296181609:AAGAOhYH-dkTEQqHw-rWHbkpGOeR4Z7OA18/sendMessage?chat_id=1760125104
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 7 IoCs
resource yara_rule behavioral1/memory/1316-59-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1316-60-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1316-63-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1316-65-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1316-67-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1316-68-0x0000000004AB0000-0x0000000004AF0000-memory.dmp family_snakekeylogger behavioral1/memory/1316-69-0x0000000004AB0000-0x0000000004AF0000-memory.dmp family_snakekeylogger -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 7 IoCs
resource yara_rule behavioral1/memory/1316-59-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1316-60-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1316-63-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1316-65-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1316-67-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1316-68-0x0000000004AB0000-0x0000000004AF0000-memory.dmp family_stormkitty behavioral1/memory/1316-69-0x0000000004AB0000-0x0000000004AF0000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe Key opened \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe Key opened \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 840 set thread context of 1316 840 08052023.exe 31 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1316 08052023.exe 1316 08052023.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1316 08052023.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 840 wrote to memory of 1388 840 08052023.exe 28 PID 840 wrote to memory of 1388 840 08052023.exe 28 PID 840 wrote to memory of 1388 840 08052023.exe 28 PID 840 wrote to memory of 1388 840 08052023.exe 28 PID 840 wrote to memory of 1376 840 08052023.exe 29 PID 840 wrote to memory of 1376 840 08052023.exe 29 PID 840 wrote to memory of 1376 840 08052023.exe 29 PID 840 wrote to memory of 1376 840 08052023.exe 29 PID 840 wrote to memory of 1484 840 08052023.exe 30 PID 840 wrote to memory of 1484 840 08052023.exe 30 PID 840 wrote to memory of 1484 840 08052023.exe 30 PID 840 wrote to memory of 1484 840 08052023.exe 30 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 PID 840 wrote to memory of 1316 840 08052023.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"2⤵PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"2⤵PID:1376
-
-
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"2⤵PID:1484
-
-
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1316
-