Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
25-09-2023 08:15
Static task
static1
Behavioral task
behavioral1
Sample
doc 202309909910101010.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
doc 202309909910101010.exe
Resource
win10v2004-20230915-en
General
-
Target
doc 202309909910101010.exe
-
Size
497KB
-
MD5
4b6ba75e0680e1761dabf95c43e777cd
-
SHA1
ac9a769d7355ea3eab0389deb2e11337cb277d48
-
SHA256
55ddf189656363ac355a799830fa17a7097a80e850bd9434e33fe2e76aacd9e5
-
SHA512
13e2e7edf9047bf059aed416fbce0ea954f4054b699d48f6fa41bb23482ee344b86499a9db4869b1bbd1aa6f53a1f43d048640e3a7ca812b1abf6c6b0d6cca70
-
SSDEEP
12288:FE725SZXXjQKQX46Hp+erzNnIyDuiNdYjJAEzq9F/+LQ:BAZN6Hp+erzNnIcKJAv
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.gkas.com.tr - Port:
587 - Username:
[email protected] - Password:
Gkasteknik@2022
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2812-17-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2812-18-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2812-21-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2812-23-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/2812-25-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
doc 202309909910101010.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 doc 202309909910101010.exe Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 doc 202309909910101010.exe Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 doc 202309909910101010.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
doc 202309909910101010.exedescription pid process target process PID 2428 set thread context of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
doc 202309909910101010.exedoc 202309909910101010.exepowershell.exepid process 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2428 doc 202309909910101010.exe 2812 doc 202309909910101010.exe 2748 powershell.exe 2812 doc 202309909910101010.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
doc 202309909910101010.exedoc 202309909910101010.exepowershell.exedescription pid process Token: SeDebugPrivilege 2428 doc 202309909910101010.exe Token: SeDebugPrivilege 2812 doc 202309909910101010.exe Token: SeDebugPrivilege 2748 powershell.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
doc 202309909910101010.exedescription pid process target process PID 2428 wrote to memory of 2748 2428 doc 202309909910101010.exe powershell.exe PID 2428 wrote to memory of 2748 2428 doc 202309909910101010.exe powershell.exe PID 2428 wrote to memory of 2748 2428 doc 202309909910101010.exe powershell.exe PID 2428 wrote to memory of 2748 2428 doc 202309909910101010.exe powershell.exe PID 2428 wrote to memory of 2788 2428 doc 202309909910101010.exe schtasks.exe PID 2428 wrote to memory of 2788 2428 doc 202309909910101010.exe schtasks.exe PID 2428 wrote to memory of 2788 2428 doc 202309909910101010.exe schtasks.exe PID 2428 wrote to memory of 2788 2428 doc 202309909910101010.exe schtasks.exe PID 2428 wrote to memory of 2620 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2620 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2620 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2620 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2100 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2100 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2100 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2100 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2340 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2340 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2340 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2340 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2604 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2604 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2604 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2604 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe PID 2428 wrote to memory of 2812 2428 doc 202309909910101010.exe doc 202309909910101010.exe -
outlook_office_path 1 IoCs
Processes:
doc 202309909910101010.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 doc 202309909910101010.exe -
outlook_win_path 1 IoCs
Processes:
doc 202309909910101010.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 doc 202309909910101010.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OYnoIhjaIinqxa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OYnoIhjaIinqxa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC9E.tmp"2⤵
- Creates scheduled task(s)
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"2⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"2⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"2⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"2⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"C:\Users\Admin\AppData\Local\Temp\doc 202309909910101010.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54494d96610c6a26154afc7b1f649b12b
SHA1364295704e893757d352cc3b62be4ec3451ece05
SHA256a8313df0e96534270d1fcd0e53a82cde1173f2bbd821cfd09b59119473f3ab1c
SHA512850ce65d06f8f41b62858d30731ee3aee2a563419951e0bcb9ff8b1219ad56d9d091e710dbab7030702268deaf20590b880454a42a323272873683d3ec24ab06