Analysis

  • max time kernel
    109s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2023, 08:24

General

  • Target

    08052023.exe

  • Size

    442KB

  • MD5

    085002173c9d09e515978b19b52e775c

  • SHA1

    f288270f7b2a6463c4e177e4f9d82a07a01c7867

  • SHA256

    e64d2225119a5860cb2d7a12914d0834d174a72d387e84b58e3d94c89aadbc58

  • SHA512

    14f5d7d535dbddd8868d48f07e892b5eccf81af4f3b5e6ecabedb3575f90e96276ff1a8e5f59a819d561a4277f0ee350f12ec800dd5d0604be4add3e9d89539e

  • SSDEEP

    6144:n4sL+pKQRtV4QMqHT9xjoOOCTJ3uWFQ+yi1apMc4uAvnhAp081nNVjqKoe:Sv8IF3uWFQ+D1apMcov6nnjqKoe

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6296181609:AAGAOhYH-dkTEQqHw-rWHbkpGOeR4Z7OA18/sendMessage?chat_id=1760125104

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08052023.exe
    "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Users\Admin\AppData\Local\Temp\08052023.exe
      "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
      2⤵
        PID:3200
      • C:\Users\Admin\AppData\Local\Temp\08052023.exe
        "C:\Users\Admin\AppData\Local\Temp\08052023.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4812

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\08052023.exe.log

            Filesize

            617B

            MD5

            99e770c0d4043aa84ef3d3cbc7723c25

            SHA1

            19829c5c413fccba750a3357f938dfa94486acad

            SHA256

            33c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5

            SHA512

            ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39

          • memory/4248-133-0x0000000000D50000-0x0000000000DC4000-memory.dmp

            Filesize

            464KB

          • memory/4248-134-0x00000000057A0000-0x000000000583C000-memory.dmp

            Filesize

            624KB

          • memory/4248-135-0x0000000005DF0000-0x0000000006394000-memory.dmp

            Filesize

            5.6MB

          • memory/4812-136-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/4812-139-0x00000000052C0000-0x00000000052D0000-memory.dmp

            Filesize

            64KB

          • memory/4812-140-0x00000000052C0000-0x00000000052D0000-memory.dmp

            Filesize

            64KB

          • memory/4812-141-0x0000000006790000-0x0000000006822000-memory.dmp

            Filesize

            584KB

          • memory/4812-142-0x0000000006710000-0x000000000671A000-memory.dmp

            Filesize

            40KB