Analysis
-
max time kernel
117s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
SİPARİŞ-290124/SİPARİŞ-290124.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SİPARİŞ-290124/SİPARİŞ-290124.exe
Resource
win10v2004-20231215-en
General
-
Target
SİPARİŞ-290124/SİPARİŞ-290124.exe
-
Size
800KB
-
MD5
36c4e62817809abfab5cc1c9249f58d4
-
SHA1
69946f5b17e210edea83a2886b86efeabc17fbb6
-
SHA256
5aae0a0a19c772865663f4317de4b8af02f4827f5f11768479d17e2093b04b0b
-
SHA512
44a3ab0fa8f2c0a84a53474ea446d4ddffecf5057953ca7c816656f15300c91aa544e4ba0f51b65510c7069f72b573fc85af6de4531298f01e0f07c05bab43bb
-
SSDEEP
12288:kf14LYrszlffoIFFHgeg/cwE7ysQ0alz9j/5i+Dodm2ANih0RBSxvjw4J1hsZO9l:pYGfXFxVtQ0eTieRBo8+
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 6 IoCs
resource yara_rule behavioral1/memory/2768-15-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2768-18-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2768-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2768-11-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2768-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2768-36-0x00000000047F0000-0x0000000004830000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1936 set thread context of 2768 1936 SİPARİŞ-290124.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2768 MSBuild.exe 2768 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2768 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 PID 1936 wrote to memory of 2768 1936 SİPARİŞ-290124.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SİPARİŞ-290124\SİPARİŞ-290124.exe"C:\Users\Admin\AppData\Local\Temp\SİPARİŞ-290124\SİPARİŞ-290124.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2768
-