Analysis

  • max time kernel
    93s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2024, 09:21

General

  • Target

    840b567a9e2a4b9d9cc93ebb3d2e551e.exe

  • Size

    728KB

  • MD5

    840b567a9e2a4b9d9cc93ebb3d2e551e

  • SHA1

    2beb298cbf5c2e85ef0afce25610ecb9a3e07513

  • SHA256

    f9c99819e882b21b76cf3397677ec58d55243ef1852c3105a3e324c4cf60dafd

  • SHA512

    9314e039acaf7003316411980c6bb1916e57e0a908fa8008590caf32d4e5f4328a540e49a77370e7b78d1c39a98d5190a748ed47866b354aee0f5e937051fbc5

  • SSDEEP

    12288:AsUhjs1UvptQgVFyxzrt7uZVbqL6vFzDOFXiWxBkEryJF4W+vHVwamVDc4/9vopU:DkWmqgVF45ayinOFXpk/MReampc4/9v9

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe
    "C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe
      "C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe"
      2⤵
        PID:2456
      • C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe
        "C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe"
        2⤵
          PID:4088
        • C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe
          "C:\Users\Admin\AppData\Local\Temp\840b567a9e2a4b9d9cc93ebb3d2e551e.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3056
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1808
            3⤵
            • Program crash
            PID:2968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3056 -ip 3056
        1⤵
          PID:1472

        Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/3056-14-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/3056-19-0x0000000074A90000-0x0000000075240000-memory.dmp

                Filesize

                7.7MB

              • memory/3056-17-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                Filesize

                64KB

              • memory/3056-15-0x0000000074A90000-0x0000000075240000-memory.dmp

                Filesize

                7.7MB

              • memory/4788-8-0x000000000A290000-0x000000000A2E6000-memory.dmp

                Filesize

                344KB

              • memory/4788-11-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                Filesize

                64KB

              • memory/4788-6-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

                Filesize

                64KB

              • memory/4788-7-0x0000000004BD0000-0x0000000004BDA000-memory.dmp

                Filesize

                40KB

              • memory/4788-0-0x0000000074A90000-0x0000000075240000-memory.dmp

                Filesize

                7.7MB

              • memory/4788-9-0x000000000CFD0000-0x000000000CFE6000-memory.dmp

                Filesize

                88KB

              • memory/4788-10-0x0000000074A90000-0x0000000075240000-memory.dmp

                Filesize

                7.7MB

              • memory/4788-5-0x000000000A330000-0x000000000A3C2000-memory.dmp

                Filesize

                584KB

              • memory/4788-12-0x0000000000BE0000-0x0000000000C6A000-memory.dmp

                Filesize

                552KB

              • memory/4788-13-0x0000000000820000-0x0000000000844000-memory.dmp

                Filesize

                144KB

              • memory/4788-4-0x000000000A840000-0x000000000ADE4000-memory.dmp

                Filesize

                5.6MB

              • memory/4788-3-0x000000000A1F0000-0x000000000A28C000-memory.dmp

                Filesize

                624KB

              • memory/4788-2-0x00000000070D0000-0x0000000007152000-memory.dmp

                Filesize

                520KB

              • memory/4788-18-0x0000000074A90000-0x0000000075240000-memory.dmp

                Filesize

                7.7MB

              • memory/4788-1-0x0000000000200000-0x00000000002BC000-memory.dmp

                Filesize

                752KB