Analysis
- max time kernel
151s - max time network
144s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
20/07/2023, 07:03
General
- Target PO-23070237 TDENGINEERING (H-0359).exe
- Size 591KB
- Sample230720-hvcvxadh21
- SHA256 ebee69a6ec18f54b490457eb4cbc49e9394f1d2128044c1545ea6eb92b515dab
Malware Config
Extracted
-
snakekeylogger
-
Protocol
ftp
-
Host
ftp://peruglobo.com/
-
Port
21
-
Username
-
Password
YSw&oCV&c23w
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-23070237 TDENGINEERING (H-0359).exe"C:\Users\Admin\AppData\Local\Temp\PO-23070237 TDENGINEERING (H-0359).exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2116-54-0x0000000000940000-0x00000000009DA000-memory.dmp
memory/2116-55-0x0000000074020000-0x000000007470E000-memory.dmp
memory/2116-56-0x0000000004DF0000-0x0000000004E30000-memory.dmp
memory/2116-57-0x0000000000350000-0x0000000000360000-memory.dmp
memory/2116-58-0x0000000074020000-0x000000007470E000-memory.dmp
memory/2116-59-0x0000000004DF0000-0x0000000004E30000-memory.dmp
memory/2116-60-0x0000000000360000-0x000000000036A000-memory.dmp
memory/2116-61-0x0000000004E90000-0x0000000004EF0000-memory.dmp
memory/2116-62-0x0000000000460000-0x0000000000486000-memory.dmp