Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/12/2023, 14:13
General
-
Target
AO XIANG FZCO Order.exe
-
Size
489KB
-
MD5
3f6fe65fc4eee365ec30277606b3c66a
-
SHA1
a919285f7dc48ddd64807744acdcc82640dfc9fd
-
SHA256
48991f467d8b22b9b36a1495de807796386f98fbadf09e01e1d913bf63951d33
-
SHA512
0f2c526ca7fd994dd1831ff513941e484960e68fc5076cfcc539c893076fae3adbfa77b18641024ef2cefe7625b2bbc3bf138786010a3660d83ca837dee5d5e5
-
SSDEEP
12288:yrpviYJS8Ea54Y0YI7LPyig/jZ0RstLE:yrpasS8v54YavPyigLWqO
Score
10/10
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AO XIANG FZCO Order.exe"C:\Users\Admin\AppData\Local\Temp\AO XIANG FZCO Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
336KB
-
Filesize
5.6MB
-
Filesize
512KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
152KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB