Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 03:25
Static task
static1
Behavioral task
behavioral1
Sample
Signed PO.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
Signed PO.exe
Resource
win10v2004-20231201-en
General
-
Target
Signed PO.exe
-
Size
530KB
-
MD5
1e9bd17b41b3d22d9f1d0ede3af18439
-
SHA1
37cbc2fc2bb09be167af47fd22a5f51d1be73383
-
SHA256
9a14222cf7f17d59fc5c4a1eff5fbfd662bf4d42c6355258d10e25c8f4ff8f2f
-
SHA512
06905c18205bdfa87eb73fe050177e915502295952fd70f73edb5b258842c953b41afc18187a2370a0bd92561438dbccc74655b595e38ba3c34add9bcf462764
-
SSDEEP
12288:KmPQaueH5qMz95lgBCDAjAFLExSdyw3xodJMqFVVU7kFtSCsqhKpkKlxdVx2:KmNqMz95OcDqAaEcFVMuACFirdVx
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2940-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2940-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2940-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2940-15-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2940-17-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Signed PO.exedescription pid process target process PID 1824 set thread context of 2940 1824 Signed PO.exe RegSvcs.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2688 2940 WerFault.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegSvcs.exepid process 2940 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2940 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Signed PO.exeRegSvcs.exedescription pid process target process PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 1824 wrote to memory of 2940 1824 Signed PO.exe RegSvcs.exe PID 2940 wrote to memory of 2688 2940 RegSvcs.exe WerFault.exe PID 2940 wrote to memory of 2688 2940 RegSvcs.exe WerFault.exe PID 2940 wrote to memory of 2688 2940 RegSvcs.exe WerFault.exe PID 2940 wrote to memory of 2688 2940 RegSvcs.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Signed PO.exe"C:\Users\Admin\AppData\Local\Temp\Signed PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 9403⤵
- Program crash
PID:2688