Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2024, 00:20

General

  • Target

    82f4ae80360792467e90af85e78fecad.exe

  • Size

    1.2MB

  • MD5

    82f4ae80360792467e90af85e78fecad

  • SHA1

    1c6c2801823fe1287638dc309661ff0a75f87623

  • SHA256

    7bc5eb4d7e5f4a51cc18540b9ed86a607ccf9979d1d19dbfd94335c8b57c70f0

  • SHA512

    ed428169ebc0293b917a53e59129e5f746eb3ef99bd485d6575d7d15fabd2557e40592aa5c8773ff85540f1c37745f464a9a6cdb1f6af19810e7cc2a8e0d91e6

  • SSDEEP

    12288:cMe5cs2aCjt1N5jaL561XniTKwEYYa0S1lFrxuHKEqs1Fiaq3ilSFeUtRFFo:cMeWBhh1N5g61XmKww62cYF/qy4FBtu

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 13 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82f4ae80360792467e90af85e78fecad.exe
    "C:\Users\Admin\AppData\Local\Temp\82f4ae80360792467e90af85e78fecad.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3076
    • C:\Users\Admin\AppData\Local\Temp\82f4ae80360792467e90af85e78fecad.exe
      "C:\Users\Admin\AppData\Local\Temp\82f4ae80360792467e90af85e78fecad.exe"
      2⤵
        PID:3400
      • C:\Users\Admin\AppData\Local\Temp\82f4ae80360792467e90af85e78fecad.exe
        "C:\Users\Admin\AppData\Local\Temp\82f4ae80360792467e90af85e78fecad.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\ProgramData\Synaptics\Synaptics.exe
          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1232
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1664
            • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
              "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1624
        • C:\Users\Admin\AppData\Local\Temp\._cache_82f4ae80360792467e90af85e78fecad.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_82f4ae80360792467e90af85e78fecad.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4772
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4944

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            216KB

            MD5

            ed6e4e44214298d62933193037c55da7

            SHA1

            cfc0e652990ee978f493fe089e419e0d3848269b

            SHA256

            26e9d47cb85cd57e4a69e0178dd84f61eef39f129a7d9c670d228bd9f7aab0cd

            SHA512

            db06d08ee7a6f5b6573710f1fe58e8286f8759c2f0f3bd057558535f012ab24802df259264c2e4f121bd481bbf74299e77ef7bbe415d85fdfcf139a051fb7753

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            176KB

            MD5

            8b4151919630ef4f1053da82cb8f1f18

            SHA1

            e6df53173d483e42b9e9c0c9d701fce276d98c05

            SHA256

            f67eab8df26386310b0cb24772603e1708b741ea8d48d2902e0fc38e304af5af

            SHA512

            f69f8802418df0c31cbde97fbbcdd1c5695b20ffc4ad0f3ae4c02bc85152857582736c2f9bc8c2cbe0e05d5b31aec396901b4999ac6904d44ce36235885b44df

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            1.2MB

            MD5

            82f4ae80360792467e90af85e78fecad

            SHA1

            1c6c2801823fe1287638dc309661ff0a75f87623

            SHA256

            7bc5eb4d7e5f4a51cc18540b9ed86a607ccf9979d1d19dbfd94335c8b57c70f0

            SHA512

            ed428169ebc0293b917a53e59129e5f746eb3ef99bd485d6575d7d15fabd2557e40592aa5c8773ff85540f1c37745f464a9a6cdb1f6af19810e7cc2a8e0d91e6

          • C:\ProgramData\Synaptics\Synaptics.exe

            Filesize

            191KB

            MD5

            af85a906922b7330b5fe5da550dba49d

            SHA1

            335a69a9c9567306d3670bd5909849ea0b7cddd0

            SHA256

            f948f1703b91b66b6c6915303cfc3914526801b14e08b41e88dbff0de751e87a

            SHA512

            e3a0431366e14f18bdb64bbdb28c8b9336e7c074ec01b0375497e876db379d2a174b12b9921b3653e8aee395fae232d8d2a6be4e91c975fc1aeff7e98a731089

          • C:\Users\Admin\AppData\Local\Temp\._cache_82f4ae80360792467e90af85e78fecad.exe

            Filesize

            121KB

            MD5

            21cbcd7e0dbd6eeb8eec1200ef03c974

            SHA1

            90935710302cca3d5a5c73d5e6d7c88c7cd82331

            SHA256

            7785ce1ba96c1fcb4c4c54205b5a989bf9652b62009ad7aadc8282d639d6e95b

            SHA512

            6762dc75623a893d5c34edc6da72c9a2d2e94bf14fb2d482c8af87fd048b77e80e48e293cc6d08759316f71ec06e64483740d567a0a6e6df800d166bae40bb71

          • C:\Users\Admin\AppData\Local\Temp\yOfNkJYi.xlsm

            Filesize

            17KB

            MD5

            e566fc53051035e1e6fd0ed1823de0f9

            SHA1

            00bc96c48b98676ecd67e81a6f1d7754e4156044

            SHA256

            8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

            SHA512

            a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

          • memory/1232-150-0x0000000004D30000-0x0000000004D40000-memory.dmp

            Filesize

            64KB

          • memory/1232-147-0x0000000004D30000-0x0000000004D40000-memory.dmp

            Filesize

            64KB

          • memory/1232-146-0x0000000073170000-0x0000000073920000-memory.dmp

            Filesize

            7.7MB

          • memory/1232-149-0x0000000073170000-0x0000000073920000-memory.dmp

            Filesize

            7.7MB

          • memory/1232-156-0x0000000073170000-0x0000000073920000-memory.dmp

            Filesize

            7.7MB

          • memory/1624-220-0x0000000002290000-0x00000000022A0000-memory.dmp

            Filesize

            64KB

          • memory/1624-219-0x00007FFCEAC60000-0x00007FFCEB721000-memory.dmp

            Filesize

            10.8MB

          • memory/1624-243-0x00007FFCEAC60000-0x00007FFCEB721000-memory.dmp

            Filesize

            10.8MB

          • memory/1664-283-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/1664-261-0x00000000027A0000-0x00000000027A1000-memory.dmp

            Filesize

            4KB

          • memory/1664-257-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/1664-157-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/1664-253-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/1664-155-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/1664-158-0x00000000027A0000-0x00000000027A1000-memory.dmp

            Filesize

            4KB

          • memory/1664-252-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/3076-8-0x0000000074480000-0x0000000074C30000-memory.dmp

            Filesize

            7.7MB

          • memory/3076-17-0x0000000074480000-0x0000000074C30000-memory.dmp

            Filesize

            7.7MB

          • memory/3076-0-0x0000000000550000-0x0000000000680000-memory.dmp

            Filesize

            1.2MB

          • memory/3076-11-0x000000000A4C0000-0x000000000A5A8000-memory.dmp

            Filesize

            928KB

          • memory/3076-10-0x0000000007D20000-0x0000000007E22000-memory.dmp

            Filesize

            1.0MB

          • memory/3076-9-0x0000000005380000-0x0000000005390000-memory.dmp

            Filesize

            64KB

          • memory/3076-7-0x00000000053A0000-0x00000000053B8000-memory.dmp

            Filesize

            96KB

          • memory/3076-6-0x0000000005100000-0x000000000510A000-memory.dmp

            Filesize

            40KB

          • memory/3076-5-0x0000000005380000-0x0000000005390000-memory.dmp

            Filesize

            64KB

          • memory/3076-4-0x00000000051C0000-0x000000000525C000-memory.dmp

            Filesize

            624KB

          • memory/3076-3-0x0000000005060000-0x00000000050F2000-memory.dmp

            Filesize

            584KB

          • memory/3076-2-0x00000000056D0000-0x0000000005C74000-memory.dmp

            Filesize

            5.6MB

          • memory/3076-1-0x0000000074480000-0x0000000074C30000-memory.dmp

            Filesize

            7.7MB

          • memory/4464-20-0x0000000001050000-0x0000000001051000-memory.dmp

            Filesize

            4KB

          • memory/4464-13-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/4464-12-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/4464-15-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/4464-16-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/4464-144-0x0000000000400000-0x00000000004E0000-memory.dmp

            Filesize

            896KB

          • memory/4772-143-0x00007FFCEAC60000-0x00007FFCEB721000-memory.dmp

            Filesize

            10.8MB

          • memory/4772-85-0x0000000000580000-0x00000000005A4000-memory.dmp

            Filesize

            144KB

          • memory/4772-145-0x000000001B230000-0x000000001B240000-memory.dmp

            Filesize

            64KB

          • memory/4772-148-0x00007FFCEAC60000-0x00007FFCEB721000-memory.dmp

            Filesize

            10.8MB

          • memory/4944-228-0x00007FFCC9E90000-0x00007FFCC9EA0000-memory.dmp

            Filesize

            64KB

          • memory/4944-221-0x00007FFCC9E90000-0x00007FFCC9EA0000-memory.dmp

            Filesize

            64KB

          • memory/4944-234-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-235-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-236-0x00007FFCC7800000-0x00007FFCC7810000-memory.dmp

            Filesize

            64KB

          • memory/4944-237-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-238-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-232-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-226-0x00007FFCC9E90000-0x00007FFCC9EA0000-memory.dmp

            Filesize

            64KB

          • memory/4944-233-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-230-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-239-0x00007FFCC7800000-0x00007FFCC7810000-memory.dmp

            Filesize

            64KB

          • memory/4944-231-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-229-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-227-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-224-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-225-0x00007FFCC9E90000-0x00007FFCC9EA0000-memory.dmp

            Filesize

            64KB

          • memory/4944-222-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-262-0x00007FFD09E10000-0x00007FFD0A005000-memory.dmp

            Filesize

            2.0MB

          • memory/4944-223-0x00007FFCC9E90000-0x00007FFCC9EA0000-memory.dmp

            Filesize

            64KB