Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:47

General

  • Target

    KVC PO1100538819.exe

  • Size

    732KB

  • MD5

    4fb089125b75694036d39124584c0374

  • SHA1

    0ce940199d1da05f9ce9834bf831be7b4fea0562

  • SHA256

    7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a

  • SHA512

    fe2eb29efa6eef24f266e3e930e689f79a7289e6a005f297b4ef501656c966d407ed17af93c2c11e2b156157d8bbc1f9568eccdb2233280924ffa0122bf514f0

  • SSDEEP

    12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 31 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe
    "C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4652

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3196-148-0x0000000074980000-0x0000000075130000-memory.dmp

          Filesize

          7.7MB

        • memory/3196-134-0x0000000074980000-0x0000000075130000-memory.dmp

          Filesize

          7.7MB

        • memory/3196-135-0x0000000005130000-0x00000000056D4000-memory.dmp

          Filesize

          5.6MB

        • memory/3196-136-0x0000000004B80000-0x0000000004C12000-memory.dmp

          Filesize

          584KB

        • memory/3196-137-0x0000000004B50000-0x0000000004B60000-memory.dmp

          Filesize

          64KB

        • memory/3196-138-0x0000000004C50000-0x0000000004C5A000-memory.dmp

          Filesize

          40KB

        • memory/3196-139-0x0000000074980000-0x0000000075130000-memory.dmp

          Filesize

          7.7MB

        • memory/3196-140-0x0000000004B50000-0x0000000004B60000-memory.dmp

          Filesize

          64KB

        • memory/3196-141-0x0000000009D60000-0x0000000009DFC000-memory.dmp

          Filesize

          624KB

        • memory/3196-133-0x0000000000120000-0x00000000001DE000-memory.dmp

          Filesize

          760KB

        • memory/4652-171-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-181-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-146-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4652-147-0x0000000074980000-0x0000000075130000-memory.dmp

          Filesize

          7.7MB

        • memory/4652-143-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4652-149-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB

        • memory/4652-151-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB

        • memory/4652-150-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB

        • memory/4652-153-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-152-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-155-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-157-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-159-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-161-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-163-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-165-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-167-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-169-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-142-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4652-173-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-175-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-177-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-179-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-145-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4652-185-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-183-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-187-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-189-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-191-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-193-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-195-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-197-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-199-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-201-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-203-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-205-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-207-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-209-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-211-0x0000000002B80000-0x0000000002BB2000-memory.dmp

          Filesize

          200KB

        • memory/4652-750-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB

        • memory/4652-751-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4652-752-0x0000000074980000-0x0000000075130000-memory.dmp

          Filesize

          7.7MB

        • memory/4652-753-0x0000000006440000-0x0000000006602000-memory.dmp

          Filesize

          1.8MB

        • memory/4652-754-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB

        • memory/4652-755-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB

        • memory/4652-756-0x00000000053C0000-0x00000000053D0000-memory.dmp

          Filesize

          64KB