Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2023 16:39
Static task
static1
Behavioral task
behavioral1
Sample
TRANSFERI.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
TRANSFERI.exe
Resource
win10v2004-20231023-en
General
-
Target
TRANSFERI.exe
-
Size
616KB
-
MD5
77521173381682b5a1deb286bce27bf4
-
SHA1
2ad56680cb0c821b18c269c63f4eeeb770140800
-
SHA256
1de5d25aecac6b32b06fe38549376748d098fd43abb5c23f73ee9ddb780080d6
-
SHA512
5366df45795f970f1b17113caf65c1e677b44da372cc85159fc4de4d8d32a08798aa4120cac956014c75fb71fce53ddfe8e76075b66c5f24e50a8f4a12254e53
-
SSDEEP
12288:h36N/bxyuAFnSz0cYMSE7a45naENKqIfPbY9QPNTURftb2pLuxQ:h3gqSznYMP5MbskYVapuQ
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.belt-tech.com.my - Port:
587 - Username:
[email protected] - Password:
Beltechpg@1234 - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1200-24-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
TRANSFERI.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation TRANSFERI.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
TRANSFERI.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TRANSFERI.exe Key opened \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TRANSFERI.exe Key opened \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TRANSFERI.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 54 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
TRANSFERI.exedescription pid process target process PID 4692 set thread context of 1200 4692 TRANSFERI.exe TRANSFERI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
TRANSFERI.exepowershell.exepowershell.exeTRANSFERI.exepid process 4692 TRANSFERI.exe 4692 TRANSFERI.exe 4692 TRANSFERI.exe 4692 TRANSFERI.exe 4692 TRANSFERI.exe 4692 TRANSFERI.exe 216 powershell.exe 216 powershell.exe 2716 powershell.exe 2716 powershell.exe 1200 TRANSFERI.exe 1200 TRANSFERI.exe 2716 powershell.exe 216 powershell.exe 1200 TRANSFERI.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
TRANSFERI.exepowershell.exepowershell.exeTRANSFERI.exedescription pid process Token: SeDebugPrivilege 4692 TRANSFERI.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 1200 TRANSFERI.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
TRANSFERI.exedescription pid process target process PID 4692 wrote to memory of 216 4692 TRANSFERI.exe powershell.exe PID 4692 wrote to memory of 216 4692 TRANSFERI.exe powershell.exe PID 4692 wrote to memory of 216 4692 TRANSFERI.exe powershell.exe PID 4692 wrote to memory of 2716 4692 TRANSFERI.exe powershell.exe PID 4692 wrote to memory of 2716 4692 TRANSFERI.exe powershell.exe PID 4692 wrote to memory of 2716 4692 TRANSFERI.exe powershell.exe PID 4692 wrote to memory of 2424 4692 TRANSFERI.exe schtasks.exe PID 4692 wrote to memory of 2424 4692 TRANSFERI.exe schtasks.exe PID 4692 wrote to memory of 2424 4692 TRANSFERI.exe schtasks.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe PID 4692 wrote to memory of 1200 4692 TRANSFERI.exe TRANSFERI.exe -
outlook_office_path 1 IoCs
Processes:
TRANSFERI.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TRANSFERI.exe -
outlook_win_path 1 IoCs
Processes:
TRANSFERI.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 TRANSFERI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TRANSFERI.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFERI.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TRANSFERI.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BwmGnyPcYGIy.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BwmGnyPcYGIy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp624F.tmp"2⤵
- Creates scheduled task(s)
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\TRANSFERI.exe"C:\Users\Admin\AppData\Local\Temp\TRANSFERI.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5a290979d8bc66e99580622eb785aceea
SHA1ccd267e920689b4627c9056ba0448f3655defb95
SHA25612297bc6e4efc4f5a03a47f6c86e2ebb67c5291bb72c2e256665436e104cc47e
SHA5123b5d80f74981d40d20e027352a87c1e4a3c45cb6fb066bc0dcfc5688438659cfd2ed1b4b59daa5feb75af5f15a6c9330adf8a92456d4a64b67861b1719f85865