Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
804c2fb52752597cd0fdae9838df7d08.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
804c2fb52752597cd0fdae9838df7d08.exe
Resource
win10v2004-20231215-en
General
-
Target
804c2fb52752597cd0fdae9838df7d08.exe
-
Size
893KB
-
MD5
804c2fb52752597cd0fdae9838df7d08
-
SHA1
a5ebf568c0e7f81a5f6854ed9a690a948f804dd2
-
SHA256
0a101b8b739c481e387e2daf5d85aaa93cf0188ff798233817e2e349b7ac1fe9
-
SHA512
dfea22fcd622b5dd02f095e9148c68c9d135c654b1974a163253f783199895f58684b55b7994ba4e227c0f25463a1795460f97a94d3c92e421d5afe7819e6f27
-
SSDEEP
12288:sJtPdGVDaHK7zTe++KINAeU+dy7fOhL8sCTqegHCcxvKIHWBSGm:sJYO+VluZL8sCTyHlZdH2S
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.trellaborg.com - Port:
587 - Username:
[email protected] - Password:
p4+vh#8Puf*N - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 7 IoCs
resource yara_rule behavioral1/memory/1940-26-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1940-24-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1940-29-0x0000000004DA0000-0x0000000004DE0000-memory.dmp family_snakekeylogger behavioral1/memory/1940-22-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1940-19-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1940-17-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1940-31-0x0000000004DA0000-0x0000000004DE0000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 8 freegeoip.app 9 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1620 set thread context of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1496 1940 WerFault.exe 33 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2732 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1620 804c2fb52752597cd0fdae9838df7d08.exe 1620 804c2fb52752597cd0fdae9838df7d08.exe 1940 804c2fb52752597cd0fdae9838df7d08.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1620 804c2fb52752597cd0fdae9838df7d08.exe Token: SeDebugPrivilege 1940 804c2fb52752597cd0fdae9838df7d08.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2732 1620 804c2fb52752597cd0fdae9838df7d08.exe 31 PID 1620 wrote to memory of 2732 1620 804c2fb52752597cd0fdae9838df7d08.exe 31 PID 1620 wrote to memory of 2732 1620 804c2fb52752597cd0fdae9838df7d08.exe 31 PID 1620 wrote to memory of 2732 1620 804c2fb52752597cd0fdae9838df7d08.exe 31 PID 1620 wrote to memory of 2548 1620 804c2fb52752597cd0fdae9838df7d08.exe 32 PID 1620 wrote to memory of 2548 1620 804c2fb52752597cd0fdae9838df7d08.exe 32 PID 1620 wrote to memory of 2548 1620 804c2fb52752597cd0fdae9838df7d08.exe 32 PID 1620 wrote to memory of 2548 1620 804c2fb52752597cd0fdae9838df7d08.exe 32 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1620 wrote to memory of 1940 1620 804c2fb52752597cd0fdae9838df7d08.exe 33 PID 1940 wrote to memory of 1496 1940 804c2fb52752597cd0fdae9838df7d08.exe 34 PID 1940 wrote to memory of 1496 1940 804c2fb52752597cd0fdae9838df7d08.exe 34 PID 1940 wrote to memory of 1496 1940 804c2fb52752597cd0fdae9838df7d08.exe 34 PID 1940 wrote to memory of 1496 1940 804c2fb52752597cd0fdae9838df7d08.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\804c2fb52752597cd0fdae9838df7d08.exe"C:\Users\Admin\AppData\Local\Temp\804c2fb52752597cd0fdae9838df7d08.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BcGxjlRX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2146.tmp"2⤵
- Creates scheduled task(s)
PID:2732
-
-
C:\Users\Admin\AppData\Local\Temp\804c2fb52752597cd0fdae9838df7d08.exe"C:\Users\Admin\AppData\Local\Temp\804c2fb52752597cd0fdae9838df7d08.exe"2⤵PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\804c2fb52752597cd0fdae9838df7d08.exe"C:\Users\Admin\AppData\Local\Temp\804c2fb52752597cd0fdae9838df7d08.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 16243⤵
- Program crash
PID:1496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e600d65493c02c763bbab01fc5fa4065
SHA1715348d8f755169ffd4ea4a5d5f87e899b543a73
SHA256ae3d8f74205682cf92a49d706900a1230724575c3accf0e052a8fc3d01fd721f
SHA512510732decf03852d6c04edc9ca377a68452a8d1cbc2d83dcecdd314bbc1a1ac2357cfb7296cfea3aaf7bd1cf2b5010cf7cae04a140d5ae0e5b2ab3fa60df8f86