Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 06:21

General

  • Target

    Siparis 02.08.023.exe

  • Size

    640KB

  • MD5

    08a2328781ea1a31a981c4474c0d097d

  • SHA1

    2eb7fbf701e8739c80ff27134a67eb6fee6bf4c0

  • SHA256

    3331e4358de7df247634699487afe492edf9af859cd588304ce9f0c6cb542cc3

  • SHA512

    8de6f3abee3d6e01d6b70cc214f7f60e518dbf7e45770b8e916d1d92bc020561f597bc6e50664f28b62c8607813f6f94e0cf9282f3d25b78969e35f4647aa5cc

  • SSDEEP

    12288:S5MY96e21JbOD5fzTmzqLLb7p8tRLPT9pDF/U:S66v2LbOlfzqGP7YLPT9pDFU

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.icdanismanlik.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Emre2010!

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe
    "C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3728
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rBsecoizqPy.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4124
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBsecoizqPy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp679E.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4064
    • C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe
      "C:\Users\Admin\AppData\Local\Temp\Siparis 02.08.023.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2212

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          2d618465e3bc8da894ba1f497df9c26a

          SHA1

          02ab403ff0eef571defc44f6042b4e556e13d12a

          SHA256

          a3fde304b506e321a6d59303397fe2abb8bd1d7ff0322f18f64f3aa17e33f137

          SHA512

          bc205034bb0cd90dbf50b1586be2d18ac97b9396f1fe40a3b1872d573d1747008210d018bcbff10413537783f5570c979eb0c92c4fd8e9775f454a1974024c00

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gfaeryvh.qr1.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp679E.tmp

          Filesize

          1KB

          MD5

          eb9e238ae1ab0ec2aafb2530d83af5fa

          SHA1

          b412e3eade99e7360eeabea1d6b0b043c2783df3

          SHA256

          45f887ba2e78c30ea0abc66f566f7e525d90e2466acffe3ed70421a9cd9b604b

          SHA512

          c559a23285b8a36b26244a1220bf175d8d4527ae7d270ab648a7ea36497c39babe8f607c91fbe11113265e3f6346de0c1110e4b7d5c40b33f1516847c53f7cf3

        • memory/2212-227-0x0000000005190000-0x00000000051A0000-memory.dmp

          Filesize

          64KB

        • memory/2212-178-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/2212-218-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/2212-157-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/2212-226-0x00000000066B0000-0x0000000006872000-memory.dmp

          Filesize

          1.8MB

        • memory/2212-180-0x0000000005190000-0x00000000051A0000-memory.dmp

          Filesize

          64KB

        • memory/3440-179-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/3440-137-0x00000000058C0000-0x00000000058D0000-memory.dmp

          Filesize

          64KB

        • memory/3440-138-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

          Filesize

          40KB

        • memory/3440-133-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/3440-134-0x0000000000EA0000-0x0000000000F46000-memory.dmp

          Filesize

          664KB

        • memory/3440-139-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/3440-140-0x00000000058C0000-0x00000000058D0000-memory.dmp

          Filesize

          64KB

        • memory/3440-136-0x00000000058F0000-0x0000000005982000-memory.dmp

          Filesize

          584KB

        • memory/3440-141-0x000000000AA20000-0x000000000AABC000-memory.dmp

          Filesize

          624KB

        • memory/3440-135-0x0000000005DC0000-0x0000000006364000-memory.dmp

          Filesize

          5.6MB

        • memory/3728-183-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/3728-146-0x0000000002FD0000-0x0000000003006000-memory.dmp

          Filesize

          216KB

        • memory/3728-156-0x00000000061F0000-0x0000000006256000-memory.dmp

          Filesize

          408KB

        • memory/3728-149-0x0000000003050000-0x0000000003060000-memory.dmp

          Filesize

          64KB

        • memory/3728-225-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/3728-150-0x0000000005AD0000-0x00000000060F8000-memory.dmp

          Filesize

          6.2MB

        • memory/3728-148-0x0000000003050000-0x0000000003060000-memory.dmp

          Filesize

          64KB

        • memory/3728-147-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/3728-168-0x0000000006260000-0x00000000062C6000-memory.dmp

          Filesize

          408KB

        • memory/3728-216-0x0000000007F20000-0x0000000007F28000-memory.dmp

          Filesize

          32KB

        • memory/3728-211-0x0000000007C70000-0x0000000007C7A000-memory.dmp

          Filesize

          40KB

        • memory/3728-215-0x0000000007F40000-0x0000000007F5A000-memory.dmp

          Filesize

          104KB

        • memory/3728-187-0x0000000071040000-0x000000007108C000-memory.dmp

          Filesize

          304KB

        • memory/3728-186-0x0000000003050000-0x0000000003060000-memory.dmp

          Filesize

          64KB

        • memory/3728-199-0x0000000006EC0000-0x0000000006EDE000-memory.dmp

          Filesize

          120KB

        • memory/3728-189-0x0000000003050000-0x0000000003060000-memory.dmp

          Filesize

          64KB

        • memory/3728-209-0x0000000008240000-0x00000000088BA000-memory.dmp

          Filesize

          6.5MB

        • memory/4124-181-0x00000000068E0000-0x00000000068FE000-memory.dmp

          Filesize

          120KB

        • memory/4124-210-0x0000000007C00000-0x0000000007C1A000-memory.dmp

          Filesize

          104KB

        • memory/4124-212-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

          Filesize

          64KB

        • memory/4124-213-0x0000000007E80000-0x0000000007F16000-memory.dmp

          Filesize

          600KB

        • memory/4124-214-0x0000000007E30000-0x0000000007E3E000-memory.dmp

          Filesize

          56KB

        • memory/4124-188-0x0000000071040000-0x000000007108C000-memory.dmp

          Filesize

          304KB

        • memory/4124-185-0x0000000006F00000-0x0000000006F32000-memory.dmp

          Filesize

          200KB

        • memory/4124-184-0x000000007EE10000-0x000000007EE20000-memory.dmp

          Filesize

          64KB

        • memory/4124-217-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/4124-182-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

          Filesize

          64KB

        • memory/4124-224-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/4124-155-0x0000000005800000-0x0000000005822000-memory.dmp

          Filesize

          136KB

        • memory/4124-153-0x0000000074AB0000-0x0000000075260000-memory.dmp

          Filesize

          7.7MB

        • memory/4124-152-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

          Filesize

          64KB

        • memory/4124-151-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

          Filesize

          64KB