Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2023, 09:53

General

  • Target

    d8a5317c8c4e740557a01574cfebf71f.exe

  • Size

    753KB

  • MD5

    d8a5317c8c4e740557a01574cfebf71f

  • SHA1

    129fe4f6b63412c22f728d7fec1da8cb69c9e0a5

  • SHA256

    c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059

  • SHA512

    4e52469c027f9a8a70cae3565bc7868b720c9249ba022db5eb4f636bb770e905e78c758792bae3174f499eb1b9ba09f359b0fa54fab811db0fa05cdd8a781916

  • SSDEEP

    12288:FfNMRf0t5/T4U0T2yhANAv3g5uFDztzT90QQpO:FfyRc3bQ22A2vjtzTiXg

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
    "C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oefbENy.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1644
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oefbENy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2088
    • C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
      "C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1236

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvh3f1tp.ii4.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp

          Filesize

          1KB

          MD5

          5b56d9b86e4027454cd47e5c13506682

          SHA1

          c43745f1a72bc879dc6ffa335e41f416e6bd3bff

          SHA256

          7fbc99891fe2af9639d0fc6d6f377314b14b4924acd16963a79af1e736d5cf63

          SHA512

          d8d9753ecc0e7ee62cc4ac74283848d1161b4e0333dd705fb15290d1757af329671b64bf2d1366963aa20447aa3bc9d122f28ae7da4b0de2e8fad0178205a594

        • memory/1236-150-0x0000000000400000-0x0000000000426000-memory.dmp

          Filesize

          152KB

        • memory/1236-198-0x00000000057D0000-0x00000000057E0000-memory.dmp

          Filesize

          64KB

        • memory/1236-196-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/1236-188-0x0000000006C00000-0x0000000006DC2000-memory.dmp

          Filesize

          1.8MB

        • memory/1236-156-0x00000000057D0000-0x00000000057E0000-memory.dmp

          Filesize

          64KB

        • memory/1236-154-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/1644-160-0x0000000005840000-0x00000000058A6000-memory.dmp

          Filesize

          408KB

        • memory/1644-157-0x00000000057A0000-0x00000000057C2000-memory.dmp

          Filesize

          136KB

        • memory/1644-197-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/1644-148-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/1644-149-0x0000000004B00000-0x0000000004B10000-memory.dmp

          Filesize

          64KB

        • memory/1644-193-0x0000000007520000-0x0000000007528000-memory.dmp

          Filesize

          32KB

        • memory/1644-151-0x0000000005140000-0x0000000005768000-memory.dmp

          Filesize

          6.2MB

        • memory/1644-152-0x0000000004B00000-0x0000000004B10000-memory.dmp

          Filesize

          64KB

        • memory/1644-192-0x0000000007540000-0x000000000755A000-memory.dmp

          Filesize

          104KB

        • memory/1644-146-0x0000000002600000-0x0000000002636000-memory.dmp

          Filesize

          216KB

        • memory/1644-191-0x0000000007430000-0x000000000743E000-memory.dmp

          Filesize

          56KB

        • memory/1644-187-0x0000000007480000-0x0000000007516000-memory.dmp

          Filesize

          600KB

        • memory/1644-190-0x0000000004B00000-0x0000000004B10000-memory.dmp

          Filesize

          64KB

        • memory/1644-189-0x0000000004B00000-0x0000000004B10000-memory.dmp

          Filesize

          64KB

        • memory/1644-169-0x0000000005F10000-0x0000000005F2E000-memory.dmp

          Filesize

          120KB

        • memory/1644-164-0x00000000058B0000-0x0000000005916000-memory.dmp

          Filesize

          408KB

        • memory/1644-170-0x0000000004B00000-0x0000000004B10000-memory.dmp

          Filesize

          64KB

        • memory/1644-171-0x00000000064D0000-0x0000000006502000-memory.dmp

          Filesize

          200KB

        • memory/1644-172-0x00000000702C0000-0x000000007030C000-memory.dmp

          Filesize

          304KB

        • memory/1644-182-0x00000000064B0000-0x00000000064CE000-memory.dmp

          Filesize

          120KB

        • memory/1644-183-0x0000000007840000-0x0000000007EBA000-memory.dmp

          Filesize

          6.5MB

        • memory/1644-184-0x0000000007200000-0x000000000721A000-memory.dmp

          Filesize

          104KB

        • memory/1644-185-0x0000000007270000-0x000000000727A000-memory.dmp

          Filesize

          40KB

        • memory/1644-186-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-155-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-138-0x00000000055F0000-0x00000000055FA000-memory.dmp

          Filesize

          40KB

        • memory/3788-135-0x0000000005AF0000-0x0000000006094000-memory.dmp

          Filesize

          5.6MB

        • memory/3788-134-0x0000000000A90000-0x0000000000B52000-memory.dmp

          Filesize

          776KB

        • memory/3788-139-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-140-0x00000000056C0000-0x00000000056D0000-memory.dmp

          Filesize

          64KB

        • memory/3788-141-0x00000000082A0000-0x000000000833C000-memory.dmp

          Filesize

          624KB

        • memory/3788-137-0x00000000056C0000-0x00000000056D0000-memory.dmp

          Filesize

          64KB

        • memory/3788-133-0x0000000074890000-0x0000000075040000-memory.dmp

          Filesize

          7.7MB

        • memory/3788-136-0x0000000005540000-0x00000000055D2000-memory.dmp

          Filesize

          584KB