Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:48

General

  • Target

    xveXYcYoRA9ESLn.exe

  • Size

    643KB

  • MD5

    6347fb31f9109c673ad871a53592aa05

  • SHA1

    e27fcd68f9a792b338243354c758beea0e5699b8

  • SHA256

    afcf2d75de98e641cb9555de188660470893d84e4c22577cd56f947e5a54223a

  • SHA512

    50f54f1680baf1a4d354fc789427a535e6016dded9340d27595908defcf68e052331a16d508d974e913ca6e120b27c8649869f450be3f36b603fa69ddc78e1cf

  • SSDEEP

    12288:15MYIRXDdvSRkM15dSe01rrG7F7Be7oyOH/ElayoBDef3TMMMDMMM:16FRXxvSRkMJArylB4oyc/ElaZefTMM7

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6454328840:AAFhLVGRU2auzr2_1A08UAoSV1INpU42j7g/sendMessage?chat_id=6315669338

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe
    "C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kmOptlGglTeN.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3092
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kmOptlGglTeN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF2D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2140
    • C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe
      "C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:4132

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xveXYcYoRA9ESLn.exe.log

          Filesize

          1KB

          MD5

          8ec831f3e3a3f77e4a7b9cd32b48384c

          SHA1

          d83f09fd87c5bd86e045873c231c14836e76a05c

          SHA256

          7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

          SHA512

          26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgbkj1qx.qgn.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmpEF2D.tmp

          Filesize

          1KB

          MD5

          260e141cc4c09a2df9eeed712a4106e4

          SHA1

          f5c582fa1b3d89d5457040b564e2877bebd88b76

          SHA256

          a36c84c55f3525b2273c2e0bc395a866e69a28b34117547526362d65051afc05

          SHA512

          01c9bb24073c82b684e664360be352bef07b5353fda9b608123c6b233ef7a8cc9f5e4adba035cc1cadab84858ebf42e42f7b8512139c2763cd2b8042f28bd2c4

        • memory/2504-136-0x0000000004C40000-0x0000000004CD2000-memory.dmp

          Filesize

          584KB

        • memory/2504-137-0x0000000004E00000-0x0000000004E10000-memory.dmp

          Filesize

          64KB

        • memory/2504-138-0x0000000004E10000-0x0000000004E1A000-memory.dmp

          Filesize

          40KB

        • memory/2504-139-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/2504-140-0x0000000004E00000-0x0000000004E10000-memory.dmp

          Filesize

          64KB

        • memory/2504-141-0x0000000009DB0000-0x0000000009E4C000-memory.dmp

          Filesize

          624KB

        • memory/2504-135-0x00000000052A0000-0x0000000005844000-memory.dmp

          Filesize

          5.6MB

        • memory/2504-133-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/2504-134-0x00000000001C0000-0x0000000000268000-memory.dmp

          Filesize

          672KB

        • memory/2504-156-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/3092-160-0x0000000005B50000-0x0000000005BB6000-memory.dmp

          Filesize

          408KB

        • memory/3092-174-0x0000000006990000-0x00000000069C2000-memory.dmp

          Filesize

          200KB

        • memory/3092-150-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/3092-200-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/3092-155-0x00000000054B0000-0x0000000005AD8000-memory.dmp

          Filesize

          6.2MB

        • memory/3092-149-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

          Filesize

          216KB

        • memory/3092-197-0x0000000007A90000-0x0000000007A98000-memory.dmp

          Filesize

          32KB

        • memory/3092-158-0x00000000052F0000-0x0000000005312000-memory.dmp

          Filesize

          136KB

        • memory/3092-159-0x0000000005AE0000-0x0000000005B46000-memory.dmp

          Filesize

          408KB

        • memory/3092-147-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/3092-146-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/3092-170-0x0000000006450000-0x000000000646E000-memory.dmp

          Filesize

          120KB

        • memory/3092-171-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/3092-172-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/3092-173-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/3092-196-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

          Filesize

          104KB

        • memory/3092-175-0x0000000070300000-0x000000007034C000-memory.dmp

          Filesize

          304KB

        • memory/3092-185-0x0000000006970000-0x000000000698E000-memory.dmp

          Filesize

          120KB

        • memory/3092-186-0x0000000007D70000-0x00000000083EA000-memory.dmp

          Filesize

          6.5MB

        • memory/3092-187-0x0000000006A70000-0x0000000006A8A000-memory.dmp

          Filesize

          104KB

        • memory/3092-188-0x0000000002A70000-0x0000000002A80000-memory.dmp

          Filesize

          64KB

        • memory/3092-189-0x0000000007740000-0x000000000774A000-memory.dmp

          Filesize

          40KB

        • memory/3092-195-0x0000000007960000-0x000000000796E000-memory.dmp

          Filesize

          56KB

        • memory/3092-193-0x0000000007970000-0x0000000007A06000-memory.dmp

          Filesize

          600KB

        • memory/4132-192-0x0000000006BE0000-0x0000000006DA2000-memory.dmp

          Filesize

          1.8MB

        • memory/4132-191-0x00000000069C0000-0x0000000006A10000-memory.dmp

          Filesize

          320KB

        • memory/4132-194-0x0000000003130000-0x0000000003140000-memory.dmp

          Filesize

          64KB

        • memory/4132-190-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB

        • memory/4132-151-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/4132-157-0x0000000003130000-0x0000000003140000-memory.dmp

          Filesize

          64KB

        • memory/4132-154-0x00000000748D0000-0x0000000075080000-memory.dmp

          Filesize

          7.7MB