Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2023, 08:47

General

  • Target

    KVC PO1100538819.exe

  • Size

    732KB

  • MD5

    4fb089125b75694036d39124584c0374

  • SHA1

    0ce940199d1da05f9ce9834bf831be7b4fea0562

  • SHA256

    7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a

  • SHA512

    fe2eb29efa6eef24f266e3e930e689f79a7289e6a005f297b4ef501656c966d407ed17af93c2c11e2b156157d8bbc1f9568eccdb2233280924ffa0122bf514f0

  • SSDEEP

    12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 8 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe
    "C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2880

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2652-54-0x00000000001D0000-0x000000000028E000-memory.dmp

          Filesize

          760KB

        • memory/2652-55-0x0000000073ED0000-0x00000000745BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2652-56-0x0000000004C60000-0x0000000004CA0000-memory.dmp

          Filesize

          256KB

        • memory/2652-57-0x0000000000620000-0x0000000000630000-memory.dmp

          Filesize

          64KB

        • memory/2652-58-0x0000000073ED0000-0x00000000745BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2652-59-0x0000000004C60000-0x0000000004CA0000-memory.dmp

          Filesize

          256KB

        • memory/2652-60-0x00000000006C0000-0x00000000006CA000-memory.dmp

          Filesize

          40KB

        • memory/2652-61-0x0000000007E40000-0x0000000007EB8000-memory.dmp

          Filesize

          480KB

        • memory/2652-72-0x0000000073ED0000-0x00000000745BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2880-71-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-74-0x0000000000FF0000-0x0000000001030000-memory.dmp

          Filesize

          256KB

        • memory/2880-65-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-66-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-67-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/2880-68-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-70-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-63-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-73-0x0000000073ED0000-0x00000000745BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2880-62-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-75-0x0000000000720000-0x000000000075A000-memory.dmp

          Filesize

          232KB

        • memory/2880-64-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-76-0x0000000000FF0000-0x0000000001030000-memory.dmp

          Filesize

          256KB

        • memory/2880-77-0x0000000000FF0000-0x0000000001030000-memory.dmp

          Filesize

          256KB

        • memory/2880-78-0x0000000000950000-0x0000000000988000-memory.dmp

          Filesize

          224KB

        • memory/2880-79-0x0000000000950000-0x0000000000982000-memory.dmp

          Filesize

          200KB

        • memory/2880-82-0x0000000000950000-0x0000000000982000-memory.dmp

          Filesize

          200KB

        • memory/2880-80-0x0000000000950000-0x0000000000982000-memory.dmp

          Filesize

          200KB

        • memory/2880-84-0x0000000000950000-0x0000000000982000-memory.dmp

          Filesize

          200KB

        • memory/2880-86-0x0000000000950000-0x0000000000982000-memory.dmp

          Filesize

          200KB

        • memory/2880-88-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/2880-89-0x0000000073ED0000-0x00000000745BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2880-90-0x0000000000FF0000-0x0000000001030000-memory.dmp

          Filesize

          256KB

        • memory/2880-91-0x0000000000FF0000-0x0000000001030000-memory.dmp

          Filesize

          256KB