Analysis

  • max time kernel
    83s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    11-05-2023 18:31

General

  • Target

    e48e8bd7c034de883faae60da15ddc3f.exe

  • Size

    653KB

  • MD5

    e48e8bd7c034de883faae60da15ddc3f

  • SHA1

    ac79da066a83feaba8a70a1f0f6456fe8e39ecc2

  • SHA256

    8e406bd2fa24428c369151006c1d3b563675ddac328964b30a6429f64f17077d

  • SHA512

    6a2c9b84e6c21657075ec854776deee7112689ece4d4cd2c0d2f5566b6802eb900dcd4edeb868112ca7654518dd9ee71e4a9ba4cff2eb848dd0aef8a995ef335

  • SSDEEP

    12288:AhmPsUOWatCsPAzRa5DFIsfhknQ3O3Fa0L/as+26q2:ImPxfQCZUlFIpnQkoJs+26

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    cp5ua.hyperhost.ua
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    7213575aceACE@#$

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 7 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e48e8bd7c034de883faae60da15ddc3f.exe
    "C:\Users\Admin\AppData\Local\Temp\e48e8bd7c034de883faae60da15ddc3f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\e48e8bd7c034de883faae60da15ddc3f.exe
      "C:\Users\Admin\AppData\Local\Temp\e48e8bd7c034de883faae60da15ddc3f.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1388

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\TarEF47.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • memory/1388-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1388-66-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1388-109-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

    Filesize

    256KB

  • memory/1388-71-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

    Filesize

    256KB

  • memory/1388-70-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1388-61-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1388-62-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1388-63-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1388-64-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1388-68-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1676-54-0x0000000001320000-0x00000000013CA000-memory.dmp

    Filesize

    680KB

  • memory/1676-57-0x0000000004DC0000-0x0000000004E00000-memory.dmp

    Filesize

    256KB

  • memory/1676-60-0x0000000005C10000-0x0000000005C58000-memory.dmp

    Filesize

    288KB

  • memory/1676-59-0x0000000005CC0000-0x0000000005D40000-memory.dmp

    Filesize

    512KB

  • memory/1676-56-0x00000000004C0000-0x00000000004D2000-memory.dmp

    Filesize

    72KB

  • memory/1676-55-0x0000000004DC0000-0x0000000004E00000-memory.dmp

    Filesize

    256KB

  • memory/1676-58-0x0000000000510000-0x000000000051A000-memory.dmp

    Filesize

    40KB