Analysis
-
max time kernel
118s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
02/08/2023, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
xveXYcYoRA9ESLn.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
xveXYcYoRA9ESLn.exe
Resource
win10v2004-20230703-en
General
-
Target
xveXYcYoRA9ESLn.exe
-
Size
643KB
-
MD5
6347fb31f9109c673ad871a53592aa05
-
SHA1
e27fcd68f9a792b338243354c758beea0e5699b8
-
SHA256
afcf2d75de98e641cb9555de188660470893d84e4c22577cd56f947e5a54223a
-
SHA512
50f54f1680baf1a4d354fc789427a535e6016dded9340d27595908defcf68e052331a16d508d974e913ca6e120b27c8649869f450be3f36b603fa69ddc78e1cf
-
SSDEEP
12288:15MYIRXDdvSRkM15dSe01rrG7F7Be7oyOH/ElayoBDef3TMMMDMMM:16FRXxvSRkMJArylB4oyc/ElaZefTMM7
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6454328840:AAFhLVGRU2auzr2_1A08UAoSV1INpU42j7g/sendMessage?chat_id=6315669338
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2936-71-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2936-73-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2936-77-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2936-79-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2936-82-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1152 set thread context of 2936 1152 xveXYcYoRA9ESLn.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1152 xveXYcYoRA9ESLn.exe 1152 xveXYcYoRA9ESLn.exe 1152 xveXYcYoRA9ESLn.exe 1152 xveXYcYoRA9ESLn.exe 2936 xveXYcYoRA9ESLn.exe 624 powershell.exe 2936 xveXYcYoRA9ESLn.exe 2936 xveXYcYoRA9ESLn.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2936 xveXYcYoRA9ESLn.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1152 xveXYcYoRA9ESLn.exe Token: SeDebugPrivilege 2936 xveXYcYoRA9ESLn.exe Token: SeDebugPrivilege 624 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1152 wrote to memory of 624 1152 xveXYcYoRA9ESLn.exe 30 PID 1152 wrote to memory of 624 1152 xveXYcYoRA9ESLn.exe 30 PID 1152 wrote to memory of 624 1152 xveXYcYoRA9ESLn.exe 30 PID 1152 wrote to memory of 624 1152 xveXYcYoRA9ESLn.exe 30 PID 1152 wrote to memory of 2756 1152 xveXYcYoRA9ESLn.exe 32 PID 1152 wrote to memory of 2756 1152 xveXYcYoRA9ESLn.exe 32 PID 1152 wrote to memory of 2756 1152 xveXYcYoRA9ESLn.exe 32 PID 1152 wrote to memory of 2756 1152 xveXYcYoRA9ESLn.exe 32 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34 PID 1152 wrote to memory of 2936 1152 xveXYcYoRA9ESLn.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kmOptlGglTeN.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kmOptlGglTeN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1870.tmp"2⤵
- Creates scheduled task(s)
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57761602311fbda97653113959526bf16
SHA1b66f8b85e4f0245c04bc60874a7af33948ddaa57
SHA2561c870d4415c12a72c58580b275ef02c2bda73f1fc889f0042eed47007444bdda
SHA51220665ed13feb32c0afa8b53b2c44b96379de224031262ed7a1e792b906f4a68ea0d030da2d486bfdbab841e93e6a623fd50b27f0d1292f3fe4550a627ea04e70