Analysis
-
max time kernel
65s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-06-2023 13:16
Static task
static1
Behavioral task
behavioral1
Sample
New order_letter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
New order_letter.exe
Resource
win10v2004-20230220-en
General
-
Target
New order_letter.exe
-
Size
1.0MB
-
MD5
67e420f5e4608735ca8b9bd040ce0ee2
-
SHA1
1d2924461a44d72abf3f8c60503335a4408fb30b
-
SHA256
b6e2c83fca7727bb38feb6e83228c4157155868ec1e088ccd8d61e15477d3ad0
-
SHA512
8d15c60671923505b85ca21120b2dc7a0c07855bee85a51c4e6098d2271987d72eb395405e3b5fe520cdefa29f88b82c636364f952faffcad7ec3dda2f2438fc
-
SSDEEP
24576:BEmFxUe2I9CPa23VRvCT033NUoGIF0z7VJO:WmFxUe2rPa23TCloGOGJ
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6288005341:AAGRgYv2o5lUGc3tnZ9QIy4L5Vg9lraTrSs/sendMessage?chat_id=6121807451
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-74-0x0000000000400000-0x000000000047C000-memory.dmp family_snakekeylogger behavioral1/memory/1604-75-0x0000000000400000-0x000000000047C000-memory.dmp family_snakekeylogger behavioral1/memory/1604-77-0x0000000000400000-0x000000000047C000-memory.dmp family_snakekeylogger behavioral1/memory/1604-79-0x0000000000400000-0x000000000047C000-memory.dmp family_snakekeylogger behavioral1/memory/1604-81-0x0000000000400000-0x000000000047C000-memory.dmp family_snakekeylogger behavioral1/memory/1676-82-0x0000000002630000-0x0000000002670000-memory.dmp family_snakekeylogger -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
New order_letter.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 New order_letter.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 New order_letter.exe Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 New order_letter.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New order_letter.exedescription pid process target process PID 1476 set thread context of 1604 1476 New order_letter.exe New order_letter.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
New order_letter.exeNew order_letter.exepowershell.exepowershell.exepid process 1476 New order_letter.exe 1476 New order_letter.exe 1476 New order_letter.exe 1476 New order_letter.exe 1476 New order_letter.exe 1476 New order_letter.exe 1604 New order_letter.exe 1476 New order_letter.exe 1860 powershell.exe 1676 powershell.exe 1604 New order_letter.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
New order_letter.exeNew order_letter.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1476 New order_letter.exe Token: SeDebugPrivilege 1604 New order_letter.exe Token: SeDebugPrivilege 1860 powershell.exe Token: SeDebugPrivilege 1676 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
New order_letter.exedescription pid process target process PID 1476 wrote to memory of 1860 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1860 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1860 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1860 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1676 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1676 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1676 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1676 1476 New order_letter.exe powershell.exe PID 1476 wrote to memory of 1608 1476 New order_letter.exe schtasks.exe PID 1476 wrote to memory of 1608 1476 New order_letter.exe schtasks.exe PID 1476 wrote to memory of 1608 1476 New order_letter.exe schtasks.exe PID 1476 wrote to memory of 1608 1476 New order_letter.exe schtasks.exe PID 1476 wrote to memory of 984 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 984 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 984 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 984 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1232 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1232 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1232 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1232 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe PID 1476 wrote to memory of 1604 1476 New order_letter.exe New order_letter.exe -
outlook_office_path 1 IoCs
Processes:
New order_letter.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 New order_letter.exe -
outlook_win_path 1 IoCs
Processes:
New order_letter.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 New order_letter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\njTHleTxYF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\njTHleTxYF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF96D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"C:\Users\Admin\AppData\Local\Temp\New order_letter.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF96D.tmpFilesize
1KB
MD55fb8a6dbfd667b0aea654cf91a46e181
SHA16a8b6264a16951c6deb8193bfd5f75af86119dab
SHA25698655c4f992f2763767dbb1eb5adedb76fa5a839b5872005190f32c31ef2dfc2
SHA512723c46a0219fc151ca7259ce97bc0a15acdb3db751e6d8df6de034e498dfba9f0084adfd69b69a53e17f8c069b6199aa01c6bcb638a680d33cbd115cb45001f3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHF899DC86XDZIO60FR3.tempFilesize
7KB
MD59184f712a46b2dc2588608a223f58aa4
SHA15b439573b59af16467f0a4f78152aa5de818ec84
SHA256077db0bf39967b289d647f9768c832c37d94146aa105633651fde50ff8a6434c
SHA512f406770e7023c5490cfdc21bd00a095d39a560e615a5c0f6965c2c871edf68415adc66b113f0a6b69ee21ef1c52f326a2f4e2114ac23a0f6a1d5b3d4ec5bed39
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD59184f712a46b2dc2588608a223f58aa4
SHA15b439573b59af16467f0a4f78152aa5de818ec84
SHA256077db0bf39967b289d647f9768c832c37d94146aa105633651fde50ff8a6434c
SHA512f406770e7023c5490cfdc21bd00a095d39a560e615a5c0f6965c2c871edf68415adc66b113f0a6b69ee21ef1c52f326a2f4e2114ac23a0f6a1d5b3d4ec5bed39
-
memory/1476-54-0x00000000010B0000-0x00000000011B6000-memory.dmpFilesize
1.0MB
-
memory/1476-55-0x0000000004DF0000-0x0000000004E30000-memory.dmpFilesize
256KB
-
memory/1476-56-0x0000000000410000-0x000000000041E000-memory.dmpFilesize
56KB
-
memory/1476-57-0x00000000007A0000-0x00000000007AA000-memory.dmpFilesize
40KB
-
memory/1476-58-0x0000000005860000-0x0000000005918000-memory.dmpFilesize
736KB
-
memory/1476-71-0x0000000005960000-0x00000000059E0000-memory.dmpFilesize
512KB
-
memory/1604-73-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-81-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-74-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-75-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1604-77-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-79-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-72-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1604-87-0x0000000000EF0000-0x0000000000F56000-memory.dmpFilesize
408KB
-
memory/1604-86-0x00000000004E0000-0x00000000004EA000-memory.dmpFilesize
40KB
-
memory/1604-84-0x0000000004B70000-0x0000000004BB0000-memory.dmpFilesize
256KB
-
memory/1676-82-0x0000000002630000-0x0000000002670000-memory.dmpFilesize
256KB
-
memory/1860-85-0x0000000002630000-0x0000000002670000-memory.dmpFilesize
256KB
-
memory/1860-83-0x0000000002630000-0x0000000002670000-memory.dmpFilesize
256KB