Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 13:54

General

  • Target

    RFQ-20240129.exe

  • Size

    906KB

  • MD5

    6d4443427f8685adac6eeb1448248f93

  • SHA1

    fa5bc1820f062cba30d413e67f61531abb96aa3d

  • SHA256

    706c041ad5d324064ea8bdcfb68f81e0fac4b6452d0629a30ce75d84592b1bd3

  • SHA512

    961b774b33bb9a6f003d1bcd8db80b5d0209ceaacfb1bfeec61719aedc988505d3ce535d9cc03ed7a6c6222a54de644b942e6567fde12196c9c3fb205d08f527

  • SSDEEP

    12288:JVfAoIFFHgeg/cSdBsV1In4qW6xzsU66kE3fldhU6MeS:JVfAXFxSu1In4F6xLHlfr263

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
    "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
      "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
      2⤵
        PID:508
      • C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe
        "C:\Users\Admin\AppData\Local\Temp\RFQ-20240129.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4844

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ-20240129.exe.log

            Filesize

            1KB

            MD5

            8ec831f3e3a3f77e4a7b9cd32b48384c

            SHA1

            d83f09fd87c5bd86e045873c231c14836e76a05c

            SHA256

            7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

            SHA512

            26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

          • memory/2616-10-0x0000000074AC0000-0x0000000075270000-memory.dmp

            Filesize

            7.7MB

          • memory/2616-2-0x0000000005C00000-0x00000000061A4000-memory.dmp

            Filesize

            5.6MB

          • memory/2616-3-0x00000000056F0000-0x0000000005782000-memory.dmp

            Filesize

            584KB

          • memory/2616-4-0x0000000005600000-0x0000000005610000-memory.dmp

            Filesize

            64KB

          • memory/2616-5-0x0000000005690000-0x000000000569A000-memory.dmp

            Filesize

            40KB

          • memory/2616-6-0x0000000005B90000-0x0000000005BAC000-memory.dmp

            Filesize

            112KB

          • memory/2616-7-0x0000000005BC0000-0x0000000005BD4000-memory.dmp

            Filesize

            80KB

          • memory/2616-8-0x0000000006B10000-0x0000000006B78000-memory.dmp

            Filesize

            416KB

          • memory/2616-0-0x0000000000B90000-0x0000000000C78000-memory.dmp

            Filesize

            928KB

          • memory/2616-9-0x0000000009230000-0x00000000092CC000-memory.dmp

            Filesize

            624KB

          • memory/2616-1-0x0000000074AC0000-0x0000000075270000-memory.dmp

            Filesize

            7.7MB

          • memory/2616-17-0x0000000074AC0000-0x0000000075270000-memory.dmp

            Filesize

            7.7MB

          • memory/2616-11-0x0000000005600000-0x0000000005610000-memory.dmp

            Filesize

            64KB

          • memory/4844-15-0x0000000074AC0000-0x0000000075270000-memory.dmp

            Filesize

            7.7MB

          • memory/4844-12-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/4844-16-0x0000000005300000-0x0000000005310000-memory.dmp

            Filesize

            64KB

          • memory/4844-18-0x0000000074AC0000-0x0000000075270000-memory.dmp

            Filesize

            7.7MB

          • memory/4844-19-0x0000000005300000-0x0000000005310000-memory.dmp

            Filesize

            64KB

          • memory/4844-20-0x00000000065A0000-0x00000000065F0000-memory.dmp

            Filesize

            320KB

          • memory/4844-21-0x00000000067C0000-0x0000000006982000-memory.dmp

            Filesize

            1.8MB