Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2023, 08:50

General

  • Target

    KVC PO1100538819.exe

  • Size

    732KB

  • MD5

    4fb089125b75694036d39124584c0374

  • SHA1

    0ce940199d1da05f9ce9834bf831be7b4fea0562

  • SHA256

    7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a

  • SHA512

    fe2eb29efa6eef24f266e3e930e689f79a7289e6a005f297b4ef501656c966d407ed17af93c2c11e2b156157d8bbc1f9568eccdb2233280924ffa0122bf514f0

  • SSDEEP

    12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 30 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe
    "C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3032

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1692-76-0x0000000073F00000-0x00000000745EE000-memory.dmp

          Filesize

          6.9MB

        • memory/1692-55-0x0000000073F00000-0x00000000745EE000-memory.dmp

          Filesize

          6.9MB

        • memory/1692-56-0x00000000004D0000-0x0000000000510000-memory.dmp

          Filesize

          256KB

        • memory/1692-57-0x0000000000510000-0x0000000000520000-memory.dmp

          Filesize

          64KB

        • memory/1692-58-0x0000000073F00000-0x00000000745EE000-memory.dmp

          Filesize

          6.9MB

        • memory/1692-59-0x00000000004D0000-0x0000000000510000-memory.dmp

          Filesize

          256KB

        • memory/1692-60-0x0000000000570000-0x000000000057A000-memory.dmp

          Filesize

          40KB

        • memory/1692-61-0x0000000005E10000-0x0000000005E88000-memory.dmp

          Filesize

          480KB

        • memory/1692-54-0x0000000000860000-0x000000000091E000-memory.dmp

          Filesize

          760KB

        • memory/3032-85-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-99-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-66-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-70-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-72-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

        • memory/3032-73-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-64-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-75-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-77-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-78-0x0000000072FF0000-0x00000000736DE000-memory.dmp

          Filesize

          6.9MB

        • memory/3032-79-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-80-0x00000000007E0000-0x000000000081A000-memory.dmp

          Filesize

          232KB

        • memory/3032-81-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-82-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-83-0x00000000021F0000-0x0000000002228000-memory.dmp

          Filesize

          224KB

        • memory/3032-84-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-89-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-91-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-87-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-62-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-93-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-95-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-97-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-68-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-101-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-103-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-105-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-107-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-109-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-111-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-113-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-115-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-117-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-119-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-121-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-123-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-125-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-127-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-129-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-131-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-133-0x00000000021F0000-0x0000000002222000-memory.dmp

          Filesize

          200KB

        • memory/3032-682-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-683-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/3032-684-0x0000000072FF0000-0x00000000736DE000-memory.dmp

          Filesize

          6.9MB

        • memory/3032-685-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-686-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-687-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB

        • memory/3032-688-0x00000000046C0000-0x0000000004700000-memory.dmp

          Filesize

          256KB