Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 08:50
Static task
static1
Behavioral task
behavioral1
Sample
131fe66006df3d7031088f28a1aaff46.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
131fe66006df3d7031088f28a1aaff46.exe
Resource
win10v2004-20231215-en
General
-
Target
131fe66006df3d7031088f28a1aaff46.exe
-
Size
767KB
-
MD5
131fe66006df3d7031088f28a1aaff46
-
SHA1
ddec6964f217b637dccd3ff9c650a9bab236a190
-
SHA256
640f83432d70d60b4449d65dc39474e50f934134f30a12487fc620ecda43c556
-
SHA512
d613909aac7d2dfb04230ea27c50ce1fcc530367edf2cb6de4c93caeeff0babb5663d33eb6de8df14a66ec0e61881310053f5d893dd96499511f89c60dc66b89
-
SSDEEP
12288:zcomEX7qKt121mFTwu99ACMPRGJhWYensuxwXCTZYadYmd+xVdjbRZwVWQVri+IQ:oomEXf1Sg1tMZGJk9xwnaeKow7mo5oFY
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
hp-tv.tk - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#$ - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/8-13-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger -
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/2832-8-0x0000000002790000-0x00000000027A2000-memory.dmp CustAttr -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 110 checkip.dyndns.org 113 freegeoip.app 114 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
131fe66006df3d7031088f28a1aaff46.exedescription pid process target process PID 2832 set thread context of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1508 8 WerFault.exe 131fe66006df3d7031088f28a1aaff46.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
131fe66006df3d7031088f28a1aaff46.exepid process 8 131fe66006df3d7031088f28a1aaff46.exe 8 131fe66006df3d7031088f28a1aaff46.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
131fe66006df3d7031088f28a1aaff46.exedescription pid process Token: SeDebugPrivilege 8 131fe66006df3d7031088f28a1aaff46.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
131fe66006df3d7031088f28a1aaff46.exedescription pid process target process PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe PID 2832 wrote to memory of 8 2832 131fe66006df3d7031088f28a1aaff46.exe 131fe66006df3d7031088f28a1aaff46.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\131fe66006df3d7031088f28a1aaff46.exe"C:\Users\Admin\AppData\Local\Temp\131fe66006df3d7031088f28a1aaff46.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\131fe66006df3d7031088f28a1aaff46.exe"C:\Users\Admin\AppData\Local\Temp\131fe66006df3d7031088f28a1aaff46.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 11083⤵
- Program crash
PID:1508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8 -ip 81⤵PID:2036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\131fe66006df3d7031088f28a1aaff46.exe.log
Filesize1KB
MD517573558c4e714f606f997e5157afaac
SHA113e16e9415ceef429aaf124139671ebeca09ed23
SHA256c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
SHA512f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc