Analysis
-
max time kernel
133s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
Kkoetzuo.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Kkoetzuo.exe
Resource
win10v2004-20230703-en
General
-
Target
Kkoetzuo.exe
-
Size
745KB
-
MD5
d0fea0443b598ea2060e7ad1fb4c5b8e
-
SHA1
bed77ada64b77184047eff265b75bd71f8136f41
-
SHA256
6894f623dddd03e3be59b6785c21962cf71686a215e2db68f83f621b01afa7ef
-
SHA512
c6e73a7ba6c713e286a45f2b34dd6eb84e0226b57045175449a4460fc622d791bd1ce781da0ffe296385decfaeb1550da2700604223a43022dd3cabc4fb9543f
-
SSDEEP
12288:SNnRIRp4ejE8krkBs5Omc1sth2pC+Fnsga0GcxgE/2:KYJkrkY41sthGGc1/
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6223040934:AAFZR7-nJPBtNtKiKjjFvb-144WYhjW9KHY/sendMessage?chat_id=6373691592
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
resource yara_rule behavioral2/memory/3220-1466-0x0000000140000000-0x0000000140024000-memory.dmp family_snakekeylogger behavioral2/memory/3220-1467-0x0000012DC1910000-0x0000012DC1920000-memory.dmp family_snakekeylogger -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ctdmdkcctf = "C:\\Users\\Admin\\AppData\\Roaming\\Ctdmdkcctf.exe" Kkoetzuo.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 44 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3076 set thread context of 3220 3076 Kkoetzuo.exe 94 -
Program crash 1 IoCs
pid pid_target Process procid_target 2260 3220 WerFault.exe 94 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3220 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3076 Kkoetzuo.exe Token: SeDebugPrivilege 3220 MSBuild.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3076 wrote to memory of 3220 3076 Kkoetzuo.exe 94 PID 3076 wrote to memory of 3220 3076 Kkoetzuo.exe 94 PID 3076 wrote to memory of 3220 3076 Kkoetzuo.exe 94 PID 3076 wrote to memory of 3220 3076 Kkoetzuo.exe 94 PID 3076 wrote to memory of 3220 3076 Kkoetzuo.exe 94 PID 3076 wrote to memory of 3220 3076 Kkoetzuo.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kkoetzuo.exe"C:\Users\Admin\AppData\Local\Temp\Kkoetzuo.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3220 -s 14043⤵
- Program crash
PID:2260
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3220 -ip 32201⤵PID:3028