Analysis
-
max time kernel
82s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-06-2023 15:08
Static task
static1
Behavioral task
behavioral1
Sample
order6566546663.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
order6566546663.exe
Resource
win10v2004-20230220-en
General
-
Target
order6566546663.exe
-
Size
643KB
-
MD5
8a728a201ff4eebc956d8747c0b689e8
-
SHA1
94fe365f40c34e83e39a4c81c7cf9319d7cfa6cc
-
SHA256
0807202daf2095810fdbc78ccf60ed83368e84da1f89d7215f9bac6590b40b7d
-
SHA512
318b968f5ce9a3caf4a2664bcc6c355463ad78fb65c09cb054ac3fd00e65f7ea454bdb7b9577c6743a01c540eca57b6527708a9008926ae8c10737231ac8511b
-
SSDEEP
12288:ioEP/SJasDrhUVMJ5kjDZCwbX9PblDCkIcxWMB:A/4pDfGDYuRblDC7cxW
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
argona.ro - Port:
26 - Username:
[email protected] - Password:
Argona12!@ - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-68-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1852-69-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1852-71-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1852-73-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/1852-75-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-68-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1852-69-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1852-71-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1852-73-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty behavioral1/memory/1852-75-0x0000000000400000-0x0000000000426000-memory.dmp family_stormkitty -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
order6566546663.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order6566546663.exe Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order6566546663.exe Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order6566546663.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
order6566546663.exedescription pid process target process PID 1204 set thread context of 1852 1204 order6566546663.exe order6566546663.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
order6566546663.exeorder6566546663.exepowershell.exepid process 1204 order6566546663.exe 1204 order6566546663.exe 1852 order6566546663.exe 580 powershell.exe 1852 order6566546663.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
order6566546663.exeorder6566546663.exepowershell.exedescription pid process Token: SeDebugPrivilege 1204 order6566546663.exe Token: SeDebugPrivilege 1852 order6566546663.exe Token: SeDebugPrivilege 580 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
order6566546663.exedescription pid process target process PID 1204 wrote to memory of 580 1204 order6566546663.exe powershell.exe PID 1204 wrote to memory of 580 1204 order6566546663.exe powershell.exe PID 1204 wrote to memory of 580 1204 order6566546663.exe powershell.exe PID 1204 wrote to memory of 580 1204 order6566546663.exe powershell.exe PID 1204 wrote to memory of 1684 1204 order6566546663.exe schtasks.exe PID 1204 wrote to memory of 1684 1204 order6566546663.exe schtasks.exe PID 1204 wrote to memory of 1684 1204 order6566546663.exe schtasks.exe PID 1204 wrote to memory of 1684 1204 order6566546663.exe schtasks.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe PID 1204 wrote to memory of 1852 1204 order6566546663.exe order6566546663.exe -
outlook_office_path 1 IoCs
Processes:
order6566546663.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order6566546663.exe -
outlook_win_path 1 IoCs
Processes:
order6566546663.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order6566546663.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKrgNXcYsk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKrgNXcYsk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB0F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"C:\Users\Admin\AppData\Local\Temp\order6566546663.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAB0F.tmpFilesize
1KB
MD5b8cca0c9487b5ef6f95ec54377972263
SHA1f057891e22ef98e2f548d1487601e8b47625a3bd
SHA25617918e0d53fab83deb492e5504c6a058f80c68dbd709f58cff302e118cb19574
SHA5129c83a152dbfb09016f9c5cc335a46ce07e4681b27fa624c1f1006286c6598df2ee11b1fca73e14792af1feb50058cc8b87f85cd1b72ae0e27f3673726206e47c
-
memory/580-79-0x00000000021B0000-0x00000000021F0000-memory.dmpFilesize
256KB
-
memory/1204-55-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/1204-56-0x0000000000480000-0x0000000000490000-memory.dmpFilesize
64KB
-
memory/1204-57-0x0000000004820000-0x0000000004860000-memory.dmpFilesize
256KB
-
memory/1204-58-0x0000000000490000-0x000000000049C000-memory.dmpFilesize
48KB
-
memory/1204-59-0x0000000005E80000-0x0000000005EE0000-memory.dmpFilesize
384KB
-
memory/1204-65-0x0000000005A70000-0x0000000005A9A000-memory.dmpFilesize
168KB
-
memory/1204-54-0x00000000009C0000-0x0000000000A68000-memory.dmpFilesize
672KB
-
memory/1852-66-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-68-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-69-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1852-71-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-73-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-75-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-78-0x0000000001F20000-0x0000000001F60000-memory.dmpFilesize
256KB
-
memory/1852-67-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1852-80-0x0000000001F20000-0x0000000001F60000-memory.dmpFilesize
256KB