Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2023 04:48
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request for Parts Order.scr
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Quotation Request for Parts Order.scr
Resource
win10v2004-20230915-en
General
-
Target
Quotation Request for Parts Order.scr
-
Size
498KB
-
MD5
2ad7546a23479cc71ad1b00920dff1d8
-
SHA1
9a6178148dbad72d7bcfe77115eef892ffbe81bc
-
SHA256
bb8869536a6b51c4676ad0411feac43b2ce06b4e342eed1a03e6927bab7b3662
-
SHA512
dc9e3a1da85a01506fb108fe0fb7359cd964af6d869ad6453d393744bb2701bb123f46e3e4cf841af4f71a1f1caff3d371b7c42dacf862317d1d74be086edc1a
-
SSDEEP
6144:dMClk8bGR3wT6MWgbqzjI/anW/uuf7ItbczYQCgp/qkQ9ygRYQKssqfHaWkeX/d6:JJbGyWM3bqI/anW/uuTYwCdsqfHaW2
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6671294732:AAET3tNjnvtkP5V6BBk7bVJCu21NfW6qI20/sendMessage?chat_id=6488147836
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2036-9-0x0000000140000000-0x0000000140022000-memory.dmp family_snakekeylogger behavioral2/memory/2036-14-0x000001DBD0750000-0x000001DBD0760000-memory.dmp family_snakekeylogger -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Quotation Request for Parts Order.scrdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Quotation Request for Parts Order.scr Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Quotation Request for Parts Order.scr Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Quotation Request for Parts Order.scr -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Quotation Request for Parts Order.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Floapnbfq = "C:\\Users\\Admin\\AppData\\Roaming\\Floapnbfq.exe" Quotation Request for Parts Order.scr -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 54 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation Request for Parts Order.scrdescription pid process target process PID 2240 set thread context of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Quotation Request for Parts Order.scrpid process 2036 Quotation Request for Parts Order.scr 2036 Quotation Request for Parts Order.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Quotation Request for Parts Order.scrQuotation Request for Parts Order.scrdescription pid process Token: SeDebugPrivilege 2240 Quotation Request for Parts Order.scr Token: SeDebugPrivilege 2036 Quotation Request for Parts Order.scr -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Quotation Request for Parts Order.scrdescription pid process target process PID 2240 wrote to memory of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr PID 2240 wrote to memory of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr PID 2240 wrote to memory of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr PID 2240 wrote to memory of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr PID 2240 wrote to memory of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr PID 2240 wrote to memory of 2036 2240 Quotation Request for Parts Order.scr Quotation Request for Parts Order.scr -
outlook_office_path 1 IoCs
Processes:
Quotation Request for Parts Order.scrdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Quotation Request for Parts Order.scr -
outlook_win_path 1 IoCs
Processes:
Quotation Request for Parts Order.scrdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Quotation Request for Parts Order.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request for Parts Order.scr"C:\Users\Admin\AppData\Local\Temp\Quotation Request for Parts Order.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\Quotation Request for Parts Order.scr"C:\Users\Admin\AppData\Local\Temp\Quotation Request for Parts Order.scr"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5159a40ccfd419bd60a20a1c278edaafd
SHA109bc35e46135b6b44c609fe6514ab7e2c8696a99
SHA25624487f4b6318683dcd81970e9f57fb45167575f687f7831a563176e20da657b6
SHA512b5c5b8c23479afff6b72c37c2cc1204c079ae003bae586d082d2b05acfdab8753fea78c5e53f692e4a45aba6746703d9ca99a2d0fa7bd88a7f35a910d1ad1ff3