Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2023, 07:04

General

  • Target

    Refbkefruvt.exe

  • Size

    587KB

  • MD5

    a58ba28556b22b42763f7e250fb0a4ee

  • SHA1

    1736c40a3405568ea7eb99626fc6787225081eac

  • SHA256

    0ebd3bc3035a85c16d9856235d470598e247755fb4b3744c32ac6bab6c4d311f

  • SHA512

    e2061c4c2ab471f4f6d7c9af420cb821f28b640f3c8b0a20fa7d994e36c0a1996922f84cc471e26518eeba3bbe059cb861371afb5c612327be9a9706f7f0abf0

  • SSDEEP

    6144:hWsTS0AV13ha4LtgdA8ICUNV9xIm683GcS+/ccP+zwrC3vGIETPm3zBzPH:k3ltga2UNKsFSJcPu

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6131487156:AAFzpoRUv23HSoE57FgrwPQiVuiha1F8Pcs/sendMessage?chat_id=6373691592

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Refbkefruvt.exe
    "C:\Users\Admin\AppData\Local\Temp\Refbkefruvt.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4928

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3252-173-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-153-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-135-0x0000012361170000-0x0000012361180000-memory.dmp

          Filesize

          64KB

        • memory/3252-136-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-137-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-139-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-141-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-143-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-145-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-147-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-149-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-151-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-177-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-155-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-157-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-159-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-161-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-163-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-165-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-167-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-169-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-171-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-134-0x00007FFD7DD70000-0x00007FFD7E831000-memory.dmp

          Filesize

          10.8MB

        • memory/3252-133-0x000001235F450000-0x000001235F4EA000-memory.dmp

          Filesize

          616KB

        • memory/3252-191-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-175-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-181-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-183-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-185-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-187-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-189-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-179-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-193-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-195-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-197-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-199-0x000001237A3B0000-0x000001237A468000-memory.dmp

          Filesize

          736KB

        • memory/3252-1152-0x00007FFD7DD70000-0x00007FFD7E831000-memory.dmp

          Filesize

          10.8MB

        • memory/3252-1213-0x0000012361170000-0x0000012361180000-memory.dmp

          Filesize

          64KB

        • memory/3252-1214-0x0000012361160000-0x0000012361161000-memory.dmp

          Filesize

          4KB

        • memory/3252-1220-0x00007FFD7DD70000-0x00007FFD7E831000-memory.dmp

          Filesize

          10.8MB

        • memory/4928-1219-0x0000000140000000-0x0000000140022000-memory.dmp

          Filesize

          136KB

        • memory/4928-1218-0x00007FFD7DD70000-0x00007FFD7E831000-memory.dmp

          Filesize

          10.8MB

        • memory/4928-1221-0x000001C69F210000-0x000001C69F220000-memory.dmp

          Filesize

          64KB

        • memory/4928-1222-0x000001C6B7A70000-0x000001C6B7AC0000-memory.dmp

          Filesize

          320KB

        • memory/4928-1223-0x000001C6B7C90000-0x000001C6B7E52000-memory.dmp

          Filesize

          1.8MB

        • memory/4928-1224-0x00007FFD7DD70000-0x00007FFD7E831000-memory.dmp

          Filesize

          10.8MB

        • memory/4928-1225-0x000001C69F210000-0x000001C69F220000-memory.dmp

          Filesize

          64KB