Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 10:46
Static task
static1
Behavioral task
behavioral1
Sample
Vhycf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Vhycf.exe
Resource
win10v2004-20230915-en
General
-
Target
Vhycf.exe
-
Size
336KB
-
MD5
452230cd897fa11773a80b7660d1eb75
-
SHA1
1e3e5ea548df2aef3db95d4243e6add49dab9688
-
SHA256
b9d4088106a3a557fb5d909c8c5b921971704d7b764306ee4190cefd9b8d89b0
-
SHA512
51b75adcffc2dc52813dfd7a0aa16df7b348084bfc4d5999346aba724b33f8891ec282002301bf42f7955f5e1169c7e9ca84af54f50823cb8e1079b1ea7233f9
-
SSDEEP
6144:7Rgc2lOrSZPpLu51ZK7VsA+JgqNb8PiFU9+j9f0GVoROChql1vHLNyk5ufH/c/dj:PS7VsARqJ86FU9+j9f0GVoROChq3vXqa
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6495173086:AAHM8NMu-uOSJHZaHij-umtWDUwi5-hOLog/sendMessage?chat_id=5262627523
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2784-10-0x0000000140000000-0x0000000140022000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Vhycf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sssss = "C:\\Users\\Admin\\AppData\\Roaming\\sssss.exe" Vhycf.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 56 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Vhycf.exedescription pid process target process PID 5044 set thread context of 2784 5044 Vhycf.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 2784 MSBuild.exe 2784 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Vhycf.exeMSBuild.exedescription pid process Token: SeDebugPrivilege 5044 Vhycf.exe Token: SeDebugPrivilege 2784 MSBuild.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Vhycf.exedescription pid process target process PID 5044 wrote to memory of 2784 5044 Vhycf.exe MSBuild.exe PID 5044 wrote to memory of 2784 5044 Vhycf.exe MSBuild.exe PID 5044 wrote to memory of 2784 5044 Vhycf.exe MSBuild.exe PID 5044 wrote to memory of 2784 5044 Vhycf.exe MSBuild.exe PID 5044 wrote to memory of 2784 5044 Vhycf.exe MSBuild.exe PID 5044 wrote to memory of 2784 5044 Vhycf.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vhycf.exe"C:\Users\Admin\AppData\Local\Temp\Vhycf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2784