Analysis
-
max time kernel
120s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26-12-2023 01:09
Static task
static1
Behavioral task
behavioral1
Sample
4816d695d08cdefc6a284fc67cd268ce.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4816d695d08cdefc6a284fc67cd268ce.exe
Resource
win10v2004-20231215-en
General
-
Target
4816d695d08cdefc6a284fc67cd268ce.exe
-
Size
673KB
-
MD5
4816d695d08cdefc6a284fc67cd268ce
-
SHA1
0cbbc8f5bb8ca25b510ca6262869b85dee2d6675
-
SHA256
9b4bb65e2911db3bbd610b6e098ae4cb0b4aafec0a959609362e72bfe607f7f6
-
SHA512
ab0d0985b888da3a4d9713bf64a17f27002307ae66a092211b18e14bc13fb2a734aac8a3237d3d33ec5e480c6ce12e4386b791d5618dff43a3af8c030837790b
-
SSDEEP
12288:q7k2iNb4sWlkNb0Q/hjFm0nUprCV6qoAddEu/NpRYU:Gk1ysWlkF/XSdGHjddEu/
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
*nGhj2BVAMZC! - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2652-9-0x0000000000400000-0x0000000000448000-memory.dmp family_snakekeylogger behavioral1/memory/2652-11-0x0000000000400000-0x0000000000448000-memory.dmp family_snakekeylogger behavioral1/memory/2652-15-0x0000000000400000-0x0000000000448000-memory.dmp family_snakekeylogger behavioral1/memory/2652-17-0x0000000000400000-0x0000000000448000-memory.dmp family_snakekeylogger behavioral1/memory/2652-19-0x0000000000400000-0x0000000000448000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org 4 freegeoip.app 5 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exedescription pid process target process PID 1380 set thread context of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exe4816d695d08cdefc6a284fc67cd268ce.exepid process 1380 4816d695d08cdefc6a284fc67cd268ce.exe 1380 4816d695d08cdefc6a284fc67cd268ce.exe 1380 4816d695d08cdefc6a284fc67cd268ce.exe 1380 4816d695d08cdefc6a284fc67cd268ce.exe 1380 4816d695d08cdefc6a284fc67cd268ce.exe 1380 4816d695d08cdefc6a284fc67cd268ce.exe 2652 4816d695d08cdefc6a284fc67cd268ce.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exe4816d695d08cdefc6a284fc67cd268ce.exedescription pid process Token: SeDebugPrivilege 1380 4816d695d08cdefc6a284fc67cd268ce.exe Token: SeDebugPrivilege 2652 4816d695d08cdefc6a284fc67cd268ce.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
4816d695d08cdefc6a284fc67cd268ce.exe4816d695d08cdefc6a284fc67cd268ce.exedescription pid process target process PID 1380 wrote to memory of 2900 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2900 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2900 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2900 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2724 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2724 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2724 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2724 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 1240 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 1240 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 1240 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 1240 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 1380 wrote to memory of 2652 1380 4816d695d08cdefc6a284fc67cd268ce.exe 4816d695d08cdefc6a284fc67cd268ce.exe PID 2652 wrote to memory of 1672 2652 4816d695d08cdefc6a284fc67cd268ce.exe dw20.exe PID 2652 wrote to memory of 1672 2652 4816d695d08cdefc6a284fc67cd268ce.exe dw20.exe PID 2652 wrote to memory of 1672 2652 4816d695d08cdefc6a284fc67cd268ce.exe dw20.exe PID 2652 wrote to memory of 1672 2652 4816d695d08cdefc6a284fc67cd268ce.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"{path}"2⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"{path}"2⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"{path}"2⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\4816d695d08cdefc6a284fc67cd268ce.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 15043⤵PID:1672