Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2023, 07:03

General

  • Target

    PAGO 49595.exe

  • Size

    590KB

  • MD5

    5771c7f376bf8760e4536e1ac832be83

  • SHA1

    011cc3fe71e481d4dd69d16fec2e328a1c542526

  • SHA256

    74e0e44962853defab1a9e26b38a812fac44b61910ea18102c3e7b227ee03ebb

  • SHA512

    a2aeb8bada76c538515712de471c710aaee012c4d9b1fc05ee4571092e23e534fef6f98bdc0b2c58b40f1ea08326d3f034cddffe5b3edd272c72ad6d2d4a9306

  • SSDEEP

    12288:aS6ln+flo/XciMv0AsRfPN1+Jexurhw4Z9dqeGFnDSvRhpb7:vTdCjE0AywJexur2YSFnDSTl7

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    UWzDeXWsD8

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAGO 49595.exe
    "C:\Users\Admin\AppData\Local\Temp\PAGO 49595.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\PAGO 49595.exe
      "C:\Users\Admin\AppData\Local\Temp\PAGO 49595.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1004
        3⤵
        • Program crash
        PID:2728

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2212-55-0x00000000743C0000-0x0000000074AAE000-memory.dmp

          Filesize

          6.9MB

        • memory/2212-54-0x0000000000DA0000-0x0000000000E3A000-memory.dmp

          Filesize

          616KB

        • memory/2212-56-0x0000000004DD0000-0x0000000004E10000-memory.dmp

          Filesize

          256KB

        • memory/2212-57-0x0000000000980000-0x0000000000990000-memory.dmp

          Filesize

          64KB

        • memory/2212-58-0x00000000743C0000-0x0000000074AAE000-memory.dmp

          Filesize

          6.9MB

        • memory/2212-59-0x0000000004DD0000-0x0000000004E10000-memory.dmp

          Filesize

          256KB

        • memory/2212-60-0x0000000000990000-0x000000000099A000-memory.dmp

          Filesize

          40KB

        • memory/2212-61-0x00000000051D0000-0x0000000005230000-memory.dmp

          Filesize

          384KB

        • memory/2212-72-0x00000000743C0000-0x0000000074AAE000-memory.dmp

          Filesize

          6.9MB

        • memory/2840-66-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-64-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-67-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2840-70-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-62-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-73-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-75-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2840-76-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2840-77-0x0000000004430000-0x0000000004470000-memory.dmp

          Filesize

          256KB

        • memory/2840-78-0x0000000074340000-0x0000000074A2E000-memory.dmp

          Filesize

          6.9MB

        • memory/2840-79-0x0000000004430000-0x0000000004470000-memory.dmp

          Filesize

          256KB