Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 14:05
Static task
static1
Behavioral task
behavioral1
Sample
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe
-
Size
757KB
-
MD5
5cf6c45026f270a5749bbcbd46a0a2ef
-
SHA1
cf1e937bf137b833280087b7d2d7fe4f9af13314
-
SHA256
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5
-
SHA512
c33ed9dd8e51f5d1b16eb3b04ba37d3e014859608bb770eaec83fc94d979106455b9e11741bba5f40bfdb248a47300da878438ab1cbef19b15f94a81bf25ef0c
-
SSDEEP
12288:wU3VTFFT2rWGxEykWNj/VDBQXMj4Yq4z6SL2DltPB/bNNcx0HgRqf9Jic0251JdS:fArxcCQu4Yq/S9
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6475845807:AAGECr5FXzQHiMYtJd3FBZgHQBCE3bsESJo/sendMessage?chat_id=2095430248
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2876-17-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral2/memory/2876-22-0x0000000005180000-0x0000000005190000-memory.dmp family_snakekeylogger behavioral2/memory/2876-26-0x0000000005180000-0x0000000005190000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 54 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription pid process target process PID 3764 set thread context of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exepid process 2876 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 2876 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription pid process Token: SeDebugPrivilege 2876 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription pid process target process PID 3764 wrote to memory of 1648 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe schtasks.exe PID 3764 wrote to memory of 1648 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe schtasks.exe PID 3764 wrote to memory of 1648 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe schtasks.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe PID 3764 wrote to memory of 2876 3764 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
outlook_office_path 1 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe -
outlook_win_path 1 IoCs
Processes:
8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe"C:\Users\Admin\AppData\Local\Temp\8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mhdwIlCVIB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D95.tmp"2⤵
- Creates scheduled task(s)
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8b62f9dade3ae9d89c385c9f1ee2cba4fc3b0b9bae19e058133bce6f2e4a6df5_JC.exe.log
Filesize1KB
MD5bb3d30439ec1e6435c3eac4df8c1d2e3
SHA1c901d5946e53ae0a9e2417c8dfaf5786a0037422
SHA256182adf89e57f80a92db9a5e13105cd59544f37855ca35f98116a0182ddd3b2e6
SHA512d3547aadf665ce2552b3dfa350b80a5e813aa346870fb2b05a3b998096eebf563143bffe964e0f7243761b79420d1adf02f735779902901d1a41a1f35c557572
-
Filesize
1KB
MD54a890329ad2f3e528364a55978934bb8
SHA1fa28e889eb851c258026a6729f2352479e043cb1
SHA256392f3b09d0188f81b1cf5c269d9af02f41afe154278851694cc35ed1f2c9fd29
SHA512a517b8e36b08e91d843b312f0e8961d1b0c7cf9e1516e62d1c651e97deb6108aa5bfd2aca1186926309d28b265958e581c2378826383028595a436de1e87c30b