Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11-10-2023 22:30
General
-
Target
a5395961ee5eeddf2c81583e2eb11dafe8f8ebcc350204e0c8344e4d3e1614e6_JC.exe
-
Size
925KB
-
MD5
6dd5b074dc21fc159a5e98c448dab3e5
-
SHA1
9be431a3d0fb17e0d7b69c62d288a7b47804fd36
-
SHA256
a5395961ee5eeddf2c81583e2eb11dafe8f8ebcc350204e0c8344e4d3e1614e6
-
SHA512
bbd3ea1bbe5e44f04973389ca391eab78f456a673fee59bbeed8368462dbc5a819bd5c929f8e5103337e3beb82002aeca5bc80ff25d3741fbe46c05c74e909db
-
SSDEEP
12288:8IOZByuDs0aOFF9EcBeK4cwyLO/uVvrvhytVJJbngUJo37DV4ELPr0MecveyyOGp:aoeeK4PmtuJUw4np3HLcp
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6576397218:AAGKDzpigihdpxoThh04ULC6usDNBiyjVcE/sendMessage?chat_id=5086753017
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5395961ee5eeddf2c81583e2eb11dafe8f8ebcc350204e0c8344e4d3e1614e6_JC.exe"C:\Users\Admin\AppData\Local\Temp\a5395961ee5eeddf2c81583e2eb11dafe8f8ebcc350204e0c8344e4d3e1614e6_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lCcCZGSzAO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD14.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\a5395961ee5eeddf2c81583e2eb11dafe8f8ebcc350204e0c8344e4d3e1614e6_JC.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bb3d30439ec1e6435c3eac4df8c1d2e3
SHA1c901d5946e53ae0a9e2417c8dfaf5786a0037422
SHA256182adf89e57f80a92db9a5e13105cd59544f37855ca35f98116a0182ddd3b2e6
SHA512d3547aadf665ce2552b3dfa350b80a5e813aa346870fb2b05a3b998096eebf563143bffe964e0f7243761b79420d1adf02f735779902901d1a41a1f35c557572
-
Filesize
1KB
MD5edf1a73154d2ac9ddf48bb0ab1dcdc85
SHA180272bf655d0325a6ca2cc1999638e134fd3b94d
SHA256f0ac75c8f33a2f2660232eeaca2c2241e3a65164dd518e42374f61e5b39121f7
SHA512f2cf0aac0f7b721ca7d2f2b16976d587a0e1683d56b68da71decd2fbd494643eac3c63ebcf0f8f3b8ce3792248b2f4a109fa18a8a0b1f6a364ba6f1bb92463f5
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
496KB
-
Filesize
792KB
-
Filesize
344KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
496KB
-
Filesize
48KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
944KB