General
-
Target
DUCTILE IRON VALVES.exe
-
Size
973KB
-
Sample
230610-l4hpasef42
-
MD5
cc040cd27bf6f03b64bc206d76e54652
-
SHA1
72982cb983b8ab0dc323e2ce193b4e837280b8f5
-
SHA256
95878513896e6bd53a77a199d6e382260ba241f52565472d923f30495ca7184f
-
SHA512
2f99ec25054ce5fdc9c9db4fe132f7d2986c9e69783e7d2e73cd87fac313c64196b86c3825116a4ff9cbca6ff1143ef5d5e9cdfde28952b95ecf93255649826b
-
SSDEEP
12288:NJseHt6nhoJXYKpC9dqWdEal9+4Kqxk17FTIr0jfnDJsZPJh:hNNXCTEg7CFUaiZhh
Static task
static1
Behavioral task
behavioral1
Sample
DUCTILE IRON VALVES.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DUCTILE IRON VALVES.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
argona.ro - Port:
26 - Username:
dan.grama@argona.ro - Password:
Argona12!@ - Email To:
trainee@valleycountysar.org
Targets
-
-
Target
DUCTILE IRON VALVES.exe
-
Size
973KB
-
MD5
cc040cd27bf6f03b64bc206d76e54652
-
SHA1
72982cb983b8ab0dc323e2ce193b4e837280b8f5
-
SHA256
95878513896e6bd53a77a199d6e382260ba241f52565472d923f30495ca7184f
-
SHA512
2f99ec25054ce5fdc9c9db4fe132f7d2986c9e69783e7d2e73cd87fac313c64196b86c3825116a4ff9cbca6ff1143ef5d5e9cdfde28952b95ecf93255649826b
-
SSDEEP
12288:NJseHt6nhoJXYKpC9dqWdEal9+4Kqxk17FTIr0jfnDJsZPJh:hNNXCTEg7CFUaiZhh
-
Snake Keylogger payload
-
StormKitty payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-