Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:50

General

  • Target

    KVC PO1100538819.exe

  • Size

    732KB

  • MD5

    4fb089125b75694036d39124584c0374

  • SHA1

    0ce940199d1da05f9ce9834bf831be7b4fea0562

  • SHA256

    7e961fe6e69522736f067afa59213ed1fe4118a470c9cf272cf15189ff47bf7a

  • SHA512

    fe2eb29efa6eef24f266e3e930e689f79a7289e6a005f297b4ef501656c966d407ed17af93c2c11e2b156157d8bbc1f9568eccdb2233280924ffa0122bf514f0

  • SSDEEP

    12288:R5MYqIHkdbQKPX7VtiVL8B5rRNH36hVCG+/HSQTibBJTS73Sv:R6hQkdbvpqL8/9NX6HCG6HSQTp7

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 33 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe
    "C:\Users\Admin\AppData\Local\Temp\KVC PO1100538819.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4788

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/680-147-0x00000000748E0000-0x0000000075090000-memory.dmp

          Filesize

          7.7MB

        • memory/680-134-0x0000000000760000-0x000000000081E000-memory.dmp

          Filesize

          760KB

        • memory/680-135-0x0000000005730000-0x0000000005CD4000-memory.dmp

          Filesize

          5.6MB

        • memory/680-136-0x0000000005220000-0x00000000052B2000-memory.dmp

          Filesize

          584KB

        • memory/680-137-0x0000000002D20000-0x0000000002D30000-memory.dmp

          Filesize

          64KB

        • memory/680-138-0x00000000051F0000-0x00000000051FA000-memory.dmp

          Filesize

          40KB

        • memory/680-139-0x00000000748E0000-0x0000000075090000-memory.dmp

          Filesize

          7.7MB

        • memory/680-140-0x0000000002D20000-0x0000000002D30000-memory.dmp

          Filesize

          64KB

        • memory/680-141-0x000000000A380000-0x000000000A41C000-memory.dmp

          Filesize

          624KB

        • memory/680-133-0x00000000748E0000-0x0000000075090000-memory.dmp

          Filesize

          7.7MB

        • memory/4788-168-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-182-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-146-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4788-143-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4788-148-0x00000000748E0000-0x0000000075090000-memory.dmp

          Filesize

          7.7MB

        • memory/4788-149-0x0000000005A10000-0x0000000005A20000-memory.dmp

          Filesize

          64KB

        • memory/4788-150-0x0000000005A10000-0x0000000005A20000-memory.dmp

          Filesize

          64KB

        • memory/4788-151-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-152-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-154-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-156-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-158-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-160-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-162-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-164-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-166-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-142-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4788-170-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-172-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-174-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-176-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-178-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-180-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-145-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4788-184-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-186-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-188-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-190-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-192-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-194-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-196-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-198-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-200-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-202-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-204-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-206-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-208-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-210-0x00000000058B0000-0x00000000058E2000-memory.dmp

          Filesize

          200KB

        • memory/4788-749-0x0000000005A10000-0x0000000005A20000-memory.dmp

          Filesize

          64KB

        • memory/4788-750-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4788-751-0x00000000748E0000-0x0000000075090000-memory.dmp

          Filesize

          7.7MB

        • memory/4788-752-0x0000000005A10000-0x0000000005A20000-memory.dmp

          Filesize

          64KB

        • memory/4788-753-0x0000000005A10000-0x0000000005A20000-memory.dmp

          Filesize

          64KB

        • memory/4788-754-0x0000000005A10000-0x0000000005A20000-memory.dmp

          Filesize

          64KB

        • memory/4788-755-0x0000000006CD0000-0x0000000006E92000-memory.dmp

          Filesize

          1.8MB