Analysis
-
max time kernel
46s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 08:27
Static task
static1
Behavioral task
behavioral1
Sample
11f9cac2f85d8bbf3f11eace2c7cfab7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
11f9cac2f85d8bbf3f11eace2c7cfab7.exe
Resource
win10v2004-20231215-en
General
-
Target
11f9cac2f85d8bbf3f11eace2c7cfab7.exe
-
Size
792KB
-
MD5
11f9cac2f85d8bbf3f11eace2c7cfab7
-
SHA1
1befd0c0c655f178408021a8673abce558c0bf61
-
SHA256
b39bd1ae1083d02d4e5a1fcbf34399e5bd28cd3b2b2d9c9569f26143767feb14
-
SHA512
c9aecfd140f9eeeabe428083dc499afc9022a5caba66d1c8d0941aad20264a3109ec1e661b4040f9a4cf77158850f1ebd3ff923c9e0048edc0faa0bddfe43cf3
-
SSDEEP
24576:+gJJjCOsBgo0q4wMPCadKqDpDtWUFf3JaC6VPk06iDj:+MdDoHMPvdKqB3JL6FkU
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
y)rZiXc(6 - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/556-8-0x0000000002A30000-0x0000000002A42000-memory.dmp CustAttr -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 99 checkip.dyndns.org 110 freegeoip.app 111 freegeoip.app -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2176 3440 WerFault.exe 11f9cac2f85d8bbf3f11eace2c7cfab7.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\11f9cac2f85d8bbf3f11eace2c7cfab7.exe"C:\Users\Admin\AppData\Local\Temp\11f9cac2f85d8bbf3f11eace2c7cfab7.exe"1⤵PID:556
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\epXekfnGdHRQNk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBD7.tmp"2⤵
- Creates scheduled task(s)
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\11f9cac2f85d8bbf3f11eace2c7cfab7.exe"C:\Users\Admin\AppData\Local\Temp\11f9cac2f85d8bbf3f11eace2c7cfab7.exe"2⤵PID:3440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 14883⤵
- Program crash
PID:2176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3440 -ip 34401⤵PID:4360
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\11f9cac2f85d8bbf3f11eace2c7cfab7.exe.log
Filesize1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
-
Filesize
1KB
MD5d56e069e00c74ab55c99df06bc5e295a
SHA149752189e9935cae877edba6e23a98748a96965c
SHA25623ee7fd7e87daf73e1f718783f4f03350dc72d04a4d3bbe4eba16c447f4ea2a3
SHA512a8090b9cecdd9ec157adf0596bd66f634f70153e4b6134615388b1499b848775c75d235ceada7758efaaf7eab67b6a55c9e5fb70e2af1f875894b4805407829c