Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20/07/2023, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
PAGO 748844.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
PAGO 748844.exe
Resource
win10v2004-20230703-en
General
-
Target
PAGO 748844.exe
-
Size
590KB
-
MD5
3974423cf3a5ca86b4cbc9c0968f62ea
-
SHA1
a88c8cce74fd4d8f767a87548fc20a22c779f099
-
SHA256
8a88d8c71eeff5031c0be922bad9639753a904fbf78536c0f8ac0619ae69d1b4
-
SHA512
14c02a57c33e61280df44cc3aea171dcebbaa1e673b7194cc2c81d13b07abef0c6c5de13b156194fce8ff054adab117be46c3bf79270e27d22b36d594d27e847
-
SSDEEP
12288:FS6ln+flo/XciMvACJKTHlqdivLfLhL+uVWayCHZwuDUIjvSbJ94u+U:MTdCjEBJyHlqdiDfLhLjVWayC5woUIjX
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.mtbooks.com.mx - Port:
587 - Username:
[email protected] - Password:
^QGUcHQjx3
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2828-64-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2828-65-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2828-68-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2828-70-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2828-73-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAGO 748844.exe Key opened \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAGO 748844.exe Key opened \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAGO 748844.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2996 set thread context of 2828 2996 PAGO 748844.exe 30 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2996 PAGO 748844.exe 2996 PAGO 748844.exe 2828 PAGO 748844.exe 2828 PAGO 748844.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2828 PAGO 748844.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2996 PAGO 748844.exe Token: SeDebugPrivilege 2828 PAGO 748844.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 PID 2996 wrote to memory of 2828 2996 PAGO 748844.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAGO 748844.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 PAGO 748844.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAGO 748844.exe"C:\Users\Admin\AppData\Local\Temp\PAGO 748844.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\PAGO 748844.exe"C:\Users\Admin\AppData\Local\Temp\PAGO 748844.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2828
-