Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2023 18:34
Static task
static1
Behavioral task
behavioral1
Sample
dekontMPS20231003.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dekontMPS20231003.exe
Resource
win10v2004-20230915-en
General
-
Target
dekontMPS20231003.exe
-
Size
420KB
-
MD5
fdc10b0a79f5e2d47f81c4f81ad4ac07
-
SHA1
1a9b020fe2e21e9ab341643c8f9e96bd8a5da095
-
SHA256
eb129d9324fffc4f901285201177387057e3d6c8f34e93aab8b08eee5b44dcb9
-
SHA512
f0c76eea93c0e23cab41f63b4f7fcae895373134933c6755c56dd6d0d0c14c953b5f0725391dfb392ff22988deeacb5a194e50ac5a87428563367fecd883918b
-
SSDEEP
12288:vQ/VsmwXLT+jUl+cQMFY523fXbfqfc/3ubyMN:4/VsdXLKjUl+cQMFYU3fXbf2c/3J
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6559576673:AAE6veQ5mMCrHEUknXuYdCi8fCjm4p3sg-0/sendMessage?chat_id=1467583453
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2388-10-0x0000000140000000-0x0000000140022000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
dekontMPS20231003.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dekontMPS20231003.exe Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dekontMPS20231003.exe Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dekontMPS20231003.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
dekontMPS20231003.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Igyvmega = "C:\\Users\\Admin\\AppData\\Roaming\\Igyvmega.exe" dekontMPS20231003.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 56 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dekontMPS20231003.exedescription pid process target process PID 3896 set thread context of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dekontMPS20231003.exepid process 2388 dekontMPS20231003.exe 2388 dekontMPS20231003.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dekontMPS20231003.exedekontMPS20231003.exedescription pid process Token: SeDebugPrivilege 3896 dekontMPS20231003.exe Token: SeDebugPrivilege 2388 dekontMPS20231003.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
dekontMPS20231003.exedescription pid process target process PID 3896 wrote to memory of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe PID 3896 wrote to memory of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe PID 3896 wrote to memory of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe PID 3896 wrote to memory of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe PID 3896 wrote to memory of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe PID 3896 wrote to memory of 2388 3896 dekontMPS20231003.exe dekontMPS20231003.exe -
outlook_office_path 1 IoCs
Processes:
dekontMPS20231003.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dekontMPS20231003.exe -
outlook_win_path 1 IoCs
Processes:
dekontMPS20231003.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dekontMPS20231003.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dekontMPS20231003.exe"C:\Users\Admin\AppData\Local\Temp\dekontMPS20231003.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\dekontMPS20231003.exeC:\Users\Admin\AppData\Local\Temp\dekontMPS20231003.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5159a40ccfd419bd60a20a1c278edaafd
SHA109bc35e46135b6b44c609fe6514ab7e2c8696a99
SHA25624487f4b6318683dcd81970e9f57fb45167575f687f7831a563176e20da657b6
SHA512b5c5b8c23479afff6b72c37c2cc1204c079ae003bae586d082d2b05acfdab8753fea78c5e53f692e4a45aba6746703d9ca99a2d0fa7bd88a7f35a910d1ad1ff3