Analysis
-
max time kernel
125s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
-
submitted
06-12-2023 03:25
General
-
Target
Signed PO.exe
-
Size
530KB
-
MD5
1e9bd17b41b3d22d9f1d0ede3af18439
-
SHA1
37cbc2fc2bb09be167af47fd22a5f51d1be73383
-
SHA256
9a14222cf7f17d59fc5c4a1eff5fbfd662bf4d42c6355258d10e25c8f4ff8f2f
-
SHA512
06905c18205bdfa87eb73fe050177e915502295952fd70f73edb5b258842c953b41afc18187a2370a0bd92561438dbccc74655b595e38ba3c34add9bcf462764
-
SSDEEP
12288:KmPQaueH5qMz95lgBCDAjAFLExSdyw3xodJMqFVVU7kFtSCsqhKpkKlxdVx2:KmNqMz95OcDqAaEcFVMuACFirdVx
Score
10/10
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Signed PO.exe"C:\Users\Admin\AppData\Local\Temp\Signed PO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 14163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 372 -ip 3721⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
552KB
-
Filesize
384KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
7.7MB