Analysis

  • max time kernel
    117s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:49

General

  • Target

    xveXYcYoRA9ESLn.exe

  • Size

    643KB

  • MD5

    6347fb31f9109c673ad871a53592aa05

  • SHA1

    e27fcd68f9a792b338243354c758beea0e5699b8

  • SHA256

    afcf2d75de98e641cb9555de188660470893d84e4c22577cd56f947e5a54223a

  • SHA512

    50f54f1680baf1a4d354fc789427a535e6016dded9340d27595908defcf68e052331a16d508d974e913ca6e120b27c8649869f450be3f36b603fa69ddc78e1cf

  • SSDEEP

    12288:15MYIRXDdvSRkM15dSe01rrG7F7Be7oyOH/ElayoBDef3TMMMDMMM:16FRXxvSRkMJArylB4oyc/ElaZefTMM7

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6454328840:AAFhLVGRU2auzr2_1A08UAoSV1INpU42j7g/sendMessage?chat_id=6315669338

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe
    "C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kmOptlGglTeN.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:680
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kmOptlGglTeN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp73B4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3720
    • C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe
      "C:\Users\Admin\AppData\Local\Temp\xveXYcYoRA9ESLn.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      PID:4256

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfso5ddl.2jo.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp73B4.tmp

          Filesize

          1KB

          MD5

          b7f1b436ad114aa2b333aa3ae4ffe82e

          SHA1

          cd442aef158ce6fd51239dba09a11d61090c9b55

          SHA256

          3f0c5c07a9ec8909463dd9802a7d9ce8759619ea88ec678a4e8d7e2a196db230

          SHA512

          dd98b127cecf55da41bb86d88ef77c9f6c4b3684041ea342fec36164df88e2c0be21fdafcb11121785133996e48416326ff3e6c1b6102aaf43c355f2a658b152

        • memory/680-185-0x0000000007650000-0x000000000765A000-memory.dmp

          Filesize

          40KB

        • memory/680-169-0x00000000062E0000-0x00000000062FE000-memory.dmp

          Filesize

          120KB

        • memory/680-197-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/680-194-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/680-193-0x0000000007900000-0x0000000007908000-memory.dmp

          Filesize

          32KB

        • memory/680-192-0x0000000007920000-0x000000000793A000-memory.dmp

          Filesize

          104KB

        • memory/680-190-0x0000000007810000-0x000000000781E000-memory.dmp

          Filesize

          56KB

        • memory/680-146-0x0000000004D10000-0x0000000004D46000-memory.dmp

          Filesize

          216KB

        • memory/680-189-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/680-148-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/680-149-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/680-150-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/680-151-0x0000000005380000-0x00000000059A8000-memory.dmp

          Filesize

          6.2MB

        • memory/680-187-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/680-153-0x0000000005B20000-0x0000000005B42000-memory.dmp

          Filesize

          136KB

        • memory/680-186-0x0000000007860000-0x00000000078F6000-memory.dmp

          Filesize

          600KB

        • memory/680-184-0x00000000075E0000-0x00000000075FA000-memory.dmp

          Filesize

          104KB

        • memory/680-158-0x0000000005BF0000-0x0000000005C56000-memory.dmp

          Filesize

          408KB

        • memory/680-183-0x0000000007C20000-0x000000000829A000-memory.dmp

          Filesize

          6.5MB

        • memory/680-166-0x0000000005ED0000-0x0000000005F36000-memory.dmp

          Filesize

          408KB

        • memory/680-182-0x0000000006870000-0x000000000688E000-memory.dmp

          Filesize

          120KB

        • memory/680-170-0x0000000004D00000-0x0000000004D10000-memory.dmp

          Filesize

          64KB

        • memory/680-172-0x0000000070730000-0x000000007077C000-memory.dmp

          Filesize

          304KB

        • memory/680-171-0x00000000068A0000-0x00000000068D2000-memory.dmp

          Filesize

          200KB

        • memory/1500-141-0x0000000009CF0000-0x0000000009D8C000-memory.dmp

          Filesize

          624KB

        • memory/1500-138-0x0000000004BD0000-0x0000000004BDA000-memory.dmp

          Filesize

          40KB

        • memory/1500-167-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/1500-133-0x0000000000120000-0x00000000001C8000-memory.dmp

          Filesize

          672KB

        • memory/1500-134-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/1500-137-0x0000000004B70000-0x0000000004B80000-memory.dmp

          Filesize

          64KB

        • memory/1500-139-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/1500-140-0x0000000004B70000-0x0000000004B80000-memory.dmp

          Filesize

          64KB

        • memory/1500-136-0x0000000004C60000-0x0000000004CF2000-memory.dmp

          Filesize

          584KB

        • memory/1500-135-0x0000000005210000-0x00000000057B4000-memory.dmp

          Filesize

          5.6MB

        • memory/4256-188-0x0000000006B70000-0x0000000006BC0000-memory.dmp

          Filesize

          320KB

        • memory/4256-168-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

          Filesize

          64KB

        • memory/4256-152-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/4256-191-0x0000000006D90000-0x0000000006F52000-memory.dmp

          Filesize

          1.8MB

        • memory/4256-155-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/4256-198-0x0000000074510000-0x0000000074CC0000-memory.dmp

          Filesize

          7.7MB

        • memory/4256-199-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

          Filesize

          64KB