General

  • Target

    Voyage Orders Detail.exe

  • Size

    759KB

  • Sample

    230610-l3xrtsfc9x

  • MD5

    95f3c49fd7969574fb9b5296c527aa13

  • SHA1

    cde40ad6dff41f36a7c314bf91ba8c9de05a029a

  • SHA256

    379ccf754b70aa15e6d95ce3ff7076eea655b6c833033c3a95e8c6108f3c0f59

  • SHA512

    8566bd4ced3c0583978bbd5fff4bed8baafe06ac8b2b63d4402ecb4a1ea2d16e08c03cbcc827099a8baa52b00e9333986f2e6d8250b8f3a5d4fcb21c74d0e35f

  • SSDEEP

    12288:2UlRuZQhaDnLMzIL2q+RTdOL8x7wTYXGr18xAOKHqZEuv1Y5tqm31wsTuEHe:2UlRugOyqGUL8x7wTYX2+mLKmuvKtqEm

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    argona.ro
  • Port:
    26
  • Username:
    dan.grama@argona.ro
  • Password:
    Argona12!@
  • Email To:
    trainee@valleycountysar.org

Targets

    • Target

      Voyage Orders Detail.exe

    • Size

      759KB

    • MD5

      95f3c49fd7969574fb9b5296c527aa13

    • SHA1

      cde40ad6dff41f36a7c314bf91ba8c9de05a029a

    • SHA256

      379ccf754b70aa15e6d95ce3ff7076eea655b6c833033c3a95e8c6108f3c0f59

    • SHA512

      8566bd4ced3c0583978bbd5fff4bed8baafe06ac8b2b63d4402ecb4a1ea2d16e08c03cbcc827099a8baa52b00e9333986f2e6d8250b8f3a5d4fcb21c74d0e35f

    • SSDEEP

      12288:2UlRuZQhaDnLMzIL2q+RTdOL8x7wTYXGr18xAOKHqZEuv1Y5tqm31wsTuEHe:2UlRugOyqGUL8x7wTYX2+mLKmuvKtqEm

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks