Analysis
-
max time kernel
109s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2023, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
08052023.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
08052023.exe
Resource
win10v2004-20230220-en
General
-
Target
08052023.exe
-
Size
442KB
-
MD5
085002173c9d09e515978b19b52e775c
-
SHA1
f288270f7b2a6463c4e177e4f9d82a07a01c7867
-
SHA256
e64d2225119a5860cb2d7a12914d0834d174a72d387e84b58e3d94c89aadbc58
-
SHA512
14f5d7d535dbddd8868d48f07e892b5eccf81af4f3b5e6ecabedb3575f90e96276ff1a8e5f59a819d561a4277f0ee350f12ec800dd5d0604be4add3e9d89539e
-
SSDEEP
6144:n4sL+pKQRtV4QMqHT9xjoOOCTJ3uWFQ+yi1apMc4uAvnhAp081nNVjqKoe:Sv8IF3uWFQ+D1apMcov6nnjqKoe
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6296181609:AAGAOhYH-dkTEQqHw-rWHbkpGOeR4Z7OA18/sendMessage?chat_id=1760125104
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/4812-136-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/4812-136-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4248 set thread context of 4812 4248 08052023.exe 84 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4812 08052023.exe 4812 08052023.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4812 08052023.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4248 wrote to memory of 3200 4248 08052023.exe 83 PID 4248 wrote to memory of 3200 4248 08052023.exe 83 PID 4248 wrote to memory of 3200 4248 08052023.exe 83 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 PID 4248 wrote to memory of 4812 4248 08052023.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 08052023.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"2⤵PID:3200
-
-
C:\Users\Admin\AppData\Local\Temp\08052023.exe"C:\Users\Admin\AppData\Local\Temp\08052023.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4812
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
617B
MD599e770c0d4043aa84ef3d3cbc7723c25
SHA119829c5c413fccba750a3357f938dfa94486acad
SHA25633c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5
SHA512ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39