Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
30-11-2023 06:56
Static task
static1
Behavioral task
behavioral1
Sample
Invoice YA 2023.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Invoice YA 2023.exe
Resource
win10v2004-20231127-en
General
-
Target
Invoice YA 2023.exe
-
Size
577KB
-
MD5
2fdd47b3a729217cdd1848ce1d832bd2
-
SHA1
80b1f475e7c906927b87b76bea1d72a0ae0ce2c7
-
SHA256
855f8c478918d0202a467a90a5ead1be7a4e87e08485106a6a545938979204ac
-
SHA512
1036403542f266d9acc5203889fa55cd95d7a11559ce65baf44bdfc2f447a0575a87399067eafa89c15fe8d93fef52b1e1fb046ec388bfdf66076b6e465587e0
-
SSDEEP
12288:ANCCCCCCC8CpCPCCsCCOcopox4IpEMEKrMZtn0Mz2YhsDZIwNP:ECCCCCCC8CpCPCCsCCNeiCjP2+sDvNP
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.belt-tech.com.my - Port:
587 - Username:
[email protected] - Password:
Beltechpg@1234 - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/524-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/524-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/524-12-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/524-15-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/524-17-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/524-19-0x0000000004A50000-0x0000000004A90000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Invoice YA 2023.exedescription pid process target process PID 2248 set thread context of 524 2248 Invoice YA 2023.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MSBuild.exepid process 524 MSBuild.exe 524 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 524 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Invoice YA 2023.exedescription pid process target process PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe PID 2248 wrote to memory of 524 2248 Invoice YA 2023.exe MSBuild.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice YA 2023.exe"C:\Users\Admin\AppData\Local\Temp\Invoice YA 2023.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:524