Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:47

General

  • Target

    Gjvdnpikd.exe

  • Size

    10KB

  • MD5

    f7707dc68ef0113a7089fcbfb241f6b4

  • SHA1

    bb82cb1fe49e8e699f2bc7a9eaa56d959f1e9c0a

  • SHA256

    c9ab09547338e5fabc9a5389c098597734e14e00da6f455d106c813177fce35e

  • SHA512

    dcba265d599a693c9a5546db4a9fd57f3c42e94dc8f7fed7f8f7c17d371fafec2bd6e0c875b80acd727cd14c96707f6403fb9226553c5ff66576f5428e34ec72

  • SSDEEP

    192:n4TPB64dwfHjA7MdRhrN47cZnSD4cli/dq:42fM7MdR8AVSLlil

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6131487156:AAFzpoRUv23HSoE57FgrwPQiVuiha1F8Pcs/sendMessage?chat_id=6373691592

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Gjvdnpikd.exe
    "C:\Users\Admin\AppData\Local\Temp\Gjvdnpikd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1776

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1776-1218-0x00007FFB3D2E0000-0x00007FFB3DDA1000-memory.dmp

          Filesize

          10.8MB

        • memory/1776-1225-0x0000026A73D20000-0x0000026A73EE2000-memory.dmp

          Filesize

          1.8MB

        • memory/1776-1224-0x0000026A5B190000-0x0000026A5B1E0000-memory.dmp

          Filesize

          320KB

        • memory/1776-1223-0x0000026A73A40000-0x0000026A73A50000-memory.dmp

          Filesize

          64KB

        • memory/1776-1222-0x00007FFB3D2E0000-0x00007FFB3DDA1000-memory.dmp

          Filesize

          10.8MB

        • memory/1776-1221-0x0000026A73A40000-0x0000026A73A50000-memory.dmp

          Filesize

          64KB

        • memory/1776-1220-0x0000000140000000-0x0000000140022000-memory.dmp

          Filesize

          136KB

        • memory/2828-173-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-181-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-149-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-147-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-151-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-153-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-155-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-157-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-159-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-161-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-163-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-165-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-167-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-169-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-171-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-133-0x0000024C4FEA0000-0x0000024C4FEA8000-memory.dmp

          Filesize

          32KB

        • memory/2828-175-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-177-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-179-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-145-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-183-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-185-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-187-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-189-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-191-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-193-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-195-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-197-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-199-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-1213-0x0000024C51C80000-0x0000024C51C81000-memory.dmp

          Filesize

          4KB

        • memory/2828-1212-0x00007FFB3D2E0000-0x00007FFB3DDA1000-memory.dmp

          Filesize

          10.8MB

        • memory/2828-1214-0x0000024C6A4B0000-0x0000024C6A4C0000-memory.dmp

          Filesize

          64KB

        • memory/2828-1219-0x00007FFB3D2E0000-0x00007FFB3DDA1000-memory.dmp

          Filesize

          10.8MB

        • memory/2828-143-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-141-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-139-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-137-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-136-0x0000024C6B070000-0x0000024C6B128000-memory.dmp

          Filesize

          736KB

        • memory/2828-135-0x0000024C6A4B0000-0x0000024C6A4C0000-memory.dmp

          Filesize

          64KB

        • memory/2828-134-0x00007FFB3D2E0000-0x00007FFB3DDA1000-memory.dmp

          Filesize

          10.8MB