Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:47

General

  • Target

    Hahza.exe

  • Size

    10KB

  • MD5

    b1553384deba6a98d1a0caa98468d0ee

  • SHA1

    f63e052ba7f25077d625f841241e2d2aa1ea7011

  • SHA256

    37840987b437459b8f5774cfd36eb5a271c61808ccfa5e4aa63b005db127f71a

  • SHA512

    807f89794347adbc82dac585656c62db9e0fd924e83ff7fffc28cd9f5f18c0859fbbc5c07c599fa41e40acd04bcb70651bd43714ffaf84b3c4a93bc7eba613a6

  • SSDEEP

    96:JG/woST6RfWsr/Kk+M1k4XpCiwe5KhBC14P3R8jleB/TA2ezNt:J6RfWsjv+M1k4XFw0Kva4P3Slc/R4

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6631000928:AAFiCjddpMvTQX5-pktE-_9Ryd2LS01DYeE/sendMessage?chat_id=5716598986

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hahza.exe
    "C:\Users\Admin\AppData\Local\Temp\Hahza.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4152

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2888-133-0x000001CC66040000-0x000001CC66048000-memory.dmp

          Filesize

          32KB

        • memory/2888-134-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

          Filesize

          10.8MB

        • memory/2888-135-0x000001CC7FFE0000-0x000001CC7FFF0000-memory.dmp

          Filesize

          64KB

        • memory/2888-136-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-137-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-139-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-141-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-143-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-145-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-147-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-149-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-151-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-153-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-155-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-157-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-159-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-161-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-163-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-165-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-167-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-169-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-171-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-173-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-175-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-177-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-179-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-181-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-183-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-185-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-187-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-189-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-191-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-193-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-195-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-197-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-199-0x000001CC00FC0000-0x000001CC01077000-memory.dmp

          Filesize

          732KB

        • memory/2888-1212-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

          Filesize

          10.8MB

        • memory/2888-1213-0x000001CC01080000-0x000001CC01081000-memory.dmp

          Filesize

          4KB

        • memory/2888-1214-0x000001CC7FFE0000-0x000001CC7FFF0000-memory.dmp

          Filesize

          64KB

        • memory/2888-1219-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

          Filesize

          10.8MB

        • memory/4152-1218-0x0000000140000000-0x0000000140022000-memory.dmp

          Filesize

          136KB

        • memory/4152-1220-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

          Filesize

          10.8MB

        • memory/4152-1221-0x00000175D9940000-0x00000175D9950000-memory.dmp

          Filesize

          64KB

        • memory/4152-1222-0x00000175F23E0000-0x00000175F2430000-memory.dmp

          Filesize

          320KB

        • memory/4152-1223-0x00000175F2600000-0x00000175F27C2000-memory.dmp

          Filesize

          1.8MB

        • memory/4152-1224-0x00007FFF27ED0000-0x00007FFF28991000-memory.dmp

          Filesize

          10.8MB

        • memory/4152-1225-0x00000175D9940000-0x00000175D9950000-memory.dmp

          Filesize

          64KB