Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
02/08/2023, 08:48
Behavioral task
behavioral1
Sample
26f6b83f00ede490164483e6f396a7b4.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
26f6b83f00ede490164483e6f396a7b4.exe
Resource
win10v2004-20230703-en
General
-
Target
26f6b83f00ede490164483e6f396a7b4.exe
-
Size
127KB
-
MD5
26f6b83f00ede490164483e6f396a7b4
-
SHA1
0f14bc46b93ddad1bf071b28b578e8489aaa3787
-
SHA256
537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0
-
SHA512
7aa0ad7b1b6d48bbb96b74619cba64cfdf4a7bce8fd0779b9dbd8927fb29a52b270150bb5086c20cbc0d883fef239d5f6f1ed4f7d68f696f64306bb327986f44
-
SSDEEP
3072:VJemedcYJyJUq2YuVAbzoZObCp4IwBtXnbY:VeGVTumbbJ3b
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.algodontekstil.com - Port:
587 - Username:
[email protected] - Password:
Alg001453 - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
resource yara_rule behavioral1/memory/2316-54-0x0000000000A70000-0x0000000000A96000-memory.dmp family_snakekeylogger behavioral1/memory/2316-56-0x00000000049A0000-0x00000000049E0000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 checkip.dyndns.org 4 freegeoip.app 5 freegeoip.app -
Program crash 1 IoCs
pid pid_target Process procid_target 1624 2316 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2316 26f6b83f00ede490164483e6f396a7b4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2316 26f6b83f00ede490164483e6f396a7b4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 1624 2316 26f6b83f00ede490164483e6f396a7b4.exe 28 PID 2316 wrote to memory of 1624 2316 26f6b83f00ede490164483e6f396a7b4.exe 28 PID 2316 wrote to memory of 1624 2316 26f6b83f00ede490164483e6f396a7b4.exe 28 PID 2316 wrote to memory of 1624 2316 26f6b83f00ede490164483e6f396a7b4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\26f6b83f00ede490164483e6f396a7b4.exe"C:\Users\Admin\AppData\Local\Temp\26f6b83f00ede490164483e6f396a7b4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 15122⤵
- Program crash
PID:1624
-