Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2024, 10:24

General

  • Target

    8231a3d38bc7b4d80468f51b116054c8.exe

  • Size

    1003KB

  • MD5

    8231a3d38bc7b4d80468f51b116054c8

  • SHA1

    3e8a9a6daf2aee6fd2c23cade11f9e60bab26e3a

  • SHA256

    09d451633478aca81c8f4c945059160bd9f45fc415e013b1e71f5a07bd865127

  • SHA512

    655711c12025172079ea0b07b0c3177004d56d378d1148e5ac6e0c569a46a38958a530b0a26214fa840248df06d98f9c3872e08245e85bd095f7a782d3fdd8a3

  • SSDEEP

    24576:9HNiHXt734s2lrIrxT7ZhNlT7dkcOs/h/0S/:9tiHXtDImhX7ecOs/h/0S

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 13 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
    "C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe
      "C:\Users\Admin\AppData\Local\Temp\8231a3d38bc7b4d80468f51b116054c8.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3904
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4360
          • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
            "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2192

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Synaptics\Synaptics.exe

          Filesize

          1003KB

          MD5

          8231a3d38bc7b4d80468f51b116054c8

          SHA1

          3e8a9a6daf2aee6fd2c23cade11f9e60bab26e3a

          SHA256

          09d451633478aca81c8f4c945059160bd9f45fc415e013b1e71f5a07bd865127

          SHA512

          655711c12025172079ea0b07b0c3177004d56d378d1148e5ac6e0c569a46a38958a530b0a26214fa840248df06d98f9c3872e08245e85bd095f7a782d3fdd8a3

        • C:\Users\Admin\AppData\Local\Temp\._cache_8231a3d38bc7b4d80468f51b116054c8.exe

          Filesize

          121KB

          MD5

          3a5c58c1a52727682465d7925559d21a

          SHA1

          f68665ef6139c41f5767b597924bc6bca3e2796a

          SHA256

          a4a844ffd175602400f333741bc0f3582030eaebb90a19f841c855d539bd2e67

          SHA512

          2f0632dcd10c9424b19678168ff97c2eef959dd31789abbe80c3ed65691dd77037789146656b869fc161c8b8e7682d1f78bd0085a41f2f71e6b1399d47dffee9

        • memory/700-10-0x0000000075320000-0x00000000758D1000-memory.dmp

          Filesize

          5.7MB

        • memory/700-3-0x0000000075320000-0x00000000758D1000-memory.dmp

          Filesize

          5.7MB

        • memory/700-4-0x0000000001080000-0x0000000001090000-memory.dmp

          Filesize

          64KB

        • memory/700-5-0x0000000001080000-0x0000000001090000-memory.dmp

          Filesize

          64KB

        • memory/700-2-0x0000000001080000-0x0000000001090000-memory.dmp

          Filesize

          64KB

        • memory/700-1-0x0000000075320000-0x00000000758D1000-memory.dmp

          Filesize

          5.7MB

        • memory/700-0-0x0000000075320000-0x00000000758D1000-memory.dmp

          Filesize

          5.7MB

        • memory/1824-6-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/1824-8-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/1824-9-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/1824-136-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/1824-12-0x0000000002A30000-0x0000000002A31000-memory.dmp

          Filesize

          4KB

        • memory/1824-11-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/2084-140-0x0000000073580000-0x0000000073B31000-memory.dmp

          Filesize

          5.7MB

        • memory/2084-156-0x0000000073580000-0x0000000073B31000-memory.dmp

          Filesize

          5.7MB

        • memory/2084-139-0x0000000001A00000-0x0000000001A10000-memory.dmp

          Filesize

          64KB

        • memory/2084-141-0x0000000073580000-0x0000000073B31000-memory.dmp

          Filesize

          5.7MB

        • memory/2084-144-0x0000000001A00000-0x0000000001A10000-memory.dmp

          Filesize

          64KB

        • memory/2084-145-0x0000000073580000-0x0000000073B31000-memory.dmp

          Filesize

          5.7MB

        • memory/2084-146-0x0000000001A00000-0x0000000001A10000-memory.dmp

          Filesize

          64KB

        • memory/2192-219-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

          Filesize

          10.8MB

        • memory/2192-218-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

          Filesize

          64KB

        • memory/2192-217-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

          Filesize

          10.8MB

        • memory/3904-143-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

          Filesize

          10.8MB

        • memory/3904-138-0x00007FFB36A20000-0x00007FFB374E1000-memory.dmp

          Filesize

          10.8MB

        • memory/3904-142-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

          Filesize

          64KB

        • memory/3904-78-0x0000000000E10000-0x0000000000E34000-memory.dmp

          Filesize

          144KB

        • memory/4360-152-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/4360-153-0x0000000001070000-0x0000000001071000-memory.dmp

          Filesize

          4KB

        • memory/4360-151-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/4360-215-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/4360-216-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/4360-220-0x0000000000400000-0x00000000004E0000-memory.dmp

          Filesize

          896KB

        • memory/4360-221-0x0000000001070000-0x0000000001071000-memory.dmp

          Filesize

          4KB