Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 06:21

General

  • Target

    Siparis 02.08.023.exe

  • Size

    640KB

  • MD5

    08a2328781ea1a31a981c4474c0d097d

  • SHA1

    2eb7fbf701e8739c80ff27134a67eb6fee6bf4c0

  • SHA256

    3331e4358de7df247634699487afe492edf9af859cd588304ce9f0c6cb542cc3

  • SHA512

    8de6f3abee3d6e01d6b70cc214f7f60e518dbf7e45770b8e916d1d92bc020561f597bc6e50664f28b62c8607813f6f94e0cf9282f3d25b78969e35f4647aa5cc

  • SSDEEP

    12288:S5MY96e21JbOD5fzTmzqLLb7p8tRLPT9pDF/U:S66v2LbOlfzqGP7YLPT9pDFU

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.icdanismanlik.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Emre2010!

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe
    "C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rBsecoizqPy.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4196
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBsecoizqPy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp966F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1784
    • C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe
      "C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3820

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          9705cc2e26833e536847128cb77248fc

          SHA1

          e6ec4c08bae27621407d2eac17bb3849d4617851

          SHA256

          568839032a5f7dd9de4fc313d7cf136a3e3ed8ce5826cc6fc4662ee877fc4127

          SHA512

          ce7740da98cbea75cec26f63f740b52cfc99c41f4a2ff59820edd85cf6587361ed132d622a21e00ac18c4c8749379b757f028dc948d32c8ef9a0aad34b5ee936

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pugau1c0.zph.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp966F.tmp

          Filesize

          1KB

          MD5

          a0640ec5bce918a9c49ac81187baec7b

          SHA1

          4eef02e9643d3943d81c8da1e7e3f7856834ea7d

          SHA256

          8e0bb1e5b5012a4ec071af2ffbac99573c655737ed658b26fe9a240f10f985ac

          SHA512

          1679f29a2f1a2164de903d19729f94a499c7a83a037ccf7a8b28e66976fee11574dfa0f99bf45087480e2400e94258d6cd7835b7d1b153d9941caaaf64becea6

        • memory/2632-179-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/2632-135-0x0000000005C60000-0x0000000006204000-memory.dmp

          Filesize

          5.6MB

        • memory/2632-139-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/2632-140-0x0000000005680000-0x0000000005690000-memory.dmp

          Filesize

          64KB

        • memory/2632-141-0x0000000009470000-0x000000000950C000-memory.dmp

          Filesize

          624KB

        • memory/2632-134-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/2632-138-0x0000000005780000-0x000000000578A000-memory.dmp

          Filesize

          40KB

        • memory/2632-136-0x00000000056B0000-0x0000000005742000-memory.dmp

          Filesize

          584KB

        • memory/2632-133-0x0000000000C60000-0x0000000000D06000-memory.dmp

          Filesize

          664KB

        • memory/2632-137-0x0000000005680000-0x0000000005690000-memory.dmp

          Filesize

          64KB

        • memory/3820-167-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/3820-229-0x0000000005570000-0x0000000005580000-memory.dmp

          Filesize

          64KB

        • memory/3820-181-0x0000000005570000-0x0000000005580000-memory.dmp

          Filesize

          64KB

        • memory/3820-178-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/3820-227-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/3820-228-0x0000000006610000-0x00000000067D2000-memory.dmp

          Filesize

          1.8MB

        • memory/4196-189-0x0000000071980000-0x00000000719CC000-memory.dmp

          Filesize

          304KB

        • memory/4196-217-0x0000000007350000-0x000000000736A000-memory.dmp

          Filesize

          104KB

        • memory/4196-152-0x00000000023D0000-0x00000000023E0000-memory.dmp

          Filesize

          64KB

        • memory/4196-151-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/4196-226-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/4196-180-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

          Filesize

          120KB

        • memory/4196-153-0x00000000023D0000-0x00000000023E0000-memory.dmp

          Filesize

          64KB

        • memory/4196-216-0x0000000007240000-0x000000000724E000-memory.dmp

          Filesize

          56KB

        • memory/4196-215-0x00000000023D0000-0x00000000023E0000-memory.dmp

          Filesize

          64KB

        • memory/4196-183-0x00000000023D0000-0x00000000023E0000-memory.dmp

          Filesize

          64KB

        • memory/4196-212-0x00000000023D0000-0x00000000023E0000-memory.dmp

          Filesize

          64KB

        • memory/4196-200-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/4196-187-0x0000000006EB0000-0x0000000006EE2000-memory.dmp

          Filesize

          200KB

        • memory/4612-148-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

          Filesize

          64KB

        • memory/4612-188-0x0000000071980000-0x00000000719CC000-memory.dmp

          Filesize

          304KB

        • memory/4612-186-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

          Filesize

          64KB

        • memory/4612-199-0x0000000006080000-0x000000000609E000-memory.dmp

          Filesize

          120KB

        • memory/4612-210-0x0000000007420000-0x0000000007A9A000-memory.dmp

          Filesize

          6.5MB

        • memory/4612-211-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

          Filesize

          104KB

        • memory/4612-185-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

          Filesize

          64KB

        • memory/4612-213-0x0000000006E50000-0x0000000006E5A000-memory.dmp

          Filesize

          40KB

        • memory/4612-214-0x0000000007060000-0x00000000070F6000-memory.dmp

          Filesize

          600KB

        • memory/4612-184-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

          Filesize

          64KB

        • memory/4612-182-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/4612-157-0x0000000005480000-0x00000000054E6000-memory.dmp

          Filesize

          408KB

        • memory/4612-218-0x0000000007100000-0x0000000007108000-memory.dmp

          Filesize

          32KB

        • memory/4612-156-0x0000000005360000-0x00000000053C6000-memory.dmp

          Filesize

          408KB

        • memory/4612-155-0x0000000004AF0000-0x0000000004B12000-memory.dmp

          Filesize

          136KB

        • memory/4612-225-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/4612-150-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

          Filesize

          64KB

        • memory/4612-149-0x0000000004C80000-0x00000000052A8000-memory.dmp

          Filesize

          6.2MB

        • memory/4612-147-0x00000000752E0000-0x0000000075A90000-memory.dmp

          Filesize

          7.7MB

        • memory/4612-146-0x0000000000D20000-0x0000000000D56000-memory.dmp

          Filesize

          216KB