Analysis
-
max time kernel
125s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2023 16:52
Static task
static1
Behavioral task
behavioral1
Sample
REMITTANCE SWIFT.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
REMITTANCE SWIFT.exe
Resource
win10v2004-20231130-en
General
-
Target
REMITTANCE SWIFT.exe
-
Size
613KB
-
MD5
f31bad5c33706d19bb437286c611c96f
-
SHA1
b1c62e91f2d3a639bc457594184d01ed70fbe70b
-
SHA256
3198d00651176dccb2f68869fd1fb7882daa1073006b963b2dc254f4e28fddf2
-
SHA512
5af7aa0e49031c4e12935555e8cae35611382b583ff1596215bdebf78946fe5fa36c93a322aa12275c359ef30cd50a7dedee526b0d5a1f0f1bbeed957898b617
-
SSDEEP
12288:UG5nF8ME6jD/cddS/YNsSGxc1wYGDYkPX19oFppwsW:UGPtD/SdS/YNsbxcfzkPXwHF
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.alualuminium.com.my - Port:
587 - Username:
[email protected] - Password:
U8G4S13#8Zk$ - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3892-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
REMITTANCE SWIFT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation REMITTANCE SWIFT.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
REMITTANCE SWIFT.exedescription pid process target process PID 432 set thread context of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3396 3892 WerFault.exe REMITTANCE SWIFT.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
REMITTANCE SWIFT.exepowershell.exepowershell.exeREMITTANCE SWIFT.exepid process 432 REMITTANCE SWIFT.exe 432 REMITTANCE SWIFT.exe 432 REMITTANCE SWIFT.exe 4372 powershell.exe 3584 powershell.exe 432 REMITTANCE SWIFT.exe 3892 REMITTANCE SWIFT.exe 3584 powershell.exe 4372 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
REMITTANCE SWIFT.exepowershell.exepowershell.exeREMITTANCE SWIFT.exedescription pid process Token: SeDebugPrivilege 432 REMITTANCE SWIFT.exe Token: SeDebugPrivilege 3584 powershell.exe Token: SeDebugPrivilege 4372 powershell.exe Token: SeDebugPrivilege 3892 REMITTANCE SWIFT.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
REMITTANCE SWIFT.exedescription pid process target process PID 432 wrote to memory of 4372 432 REMITTANCE SWIFT.exe powershell.exe PID 432 wrote to memory of 4372 432 REMITTANCE SWIFT.exe powershell.exe PID 432 wrote to memory of 4372 432 REMITTANCE SWIFT.exe powershell.exe PID 432 wrote to memory of 3584 432 REMITTANCE SWIFT.exe powershell.exe PID 432 wrote to memory of 3584 432 REMITTANCE SWIFT.exe powershell.exe PID 432 wrote to memory of 3584 432 REMITTANCE SWIFT.exe powershell.exe PID 432 wrote to memory of 808 432 REMITTANCE SWIFT.exe schtasks.exe PID 432 wrote to memory of 808 432 REMITTANCE SWIFT.exe schtasks.exe PID 432 wrote to memory of 808 432 REMITTANCE SWIFT.exe schtasks.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe PID 432 wrote to memory of 3892 432 REMITTANCE SWIFT.exe REMITTANCE SWIFT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\REMITTANCE SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE SWIFT.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GgPjILmv.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\REMITTANCE SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\REMITTANCE SWIFT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 14523⤵
- Program crash
PID:3396 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GgPjILmv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp"2⤵
- Creates scheduled task(s)
PID:808 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\REMITTANCE SWIFT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3892 -ip 38921⤵PID:224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD52aa17d6b20a683c8d348729433bfa8e8
SHA1ee088408a02423749589bb030f6aeafdcf425a25
SHA256624bccfc2e8dd4b5babed2a9f77c6ea70ea576bb1011fe83cd79df72f9a97b4b
SHA512d7bf88af0bbf719bf5e50ca9df7ce7f1aff9ede14f55f15cab6efee88ab349e2a0bf0434e872e001660652cac21e9c13d5334316171eebc56011e21647886bed
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5c5eb03421c327495154b848b15d37565
SHA1690472987bbed08dda98fe2919646724937d9217
SHA256a33c90e548bd642ae380eee7f5cb414671d69c205ebf159739cec2231f9d2272
SHA512c6f4457ce55a978028e4c16a33acd43a2886574529bec72e7ea665ac98600a3ed960e9b35c773e42bc7dc83cbefa8530e40ba85119e8a9a8fac80cb3041aed64