Analysis
- max time kernel
118s - max time network
130s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
- submitted
06/02/2024, 09:24
General
- Target SecuriteInfo.com.Win32.PWSX-gen.32566.31866.exe
- Size 788KB
- Sample240206-lc2cbsefhl
- SHA256 0362ca22d88c46b40010c8d847a769ff5942df7071968f00911a41b59e1a59a5
Malware Config
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 7 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.32566.31866.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.32566.31866.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1520-0-0x0000000001220000-0x00000000012EC000-memory.dmp
memory/1520-1-0x0000000074B70000-0x000000007525E000-memory.dmp
memory/1520-2-0x0000000000CD0000-0x0000000000D10000-memory.dmp
memory/1520-3-0x00000000002C0000-0x00000000002D4000-memory.dmp
memory/1520-4-0x0000000000300000-0x000000000030A000-memory.dmp
memory/1520-5-0x0000000000310000-0x000000000031E000-memory.dmp
memory/1520-6-0x0000000004CA0000-0x0000000004D08000-memory.dmp
memory/1520-7-0x0000000074B70000-0x000000007525E000-memory.dmp
memory/1520-8-0x0000000000CD0000-0x0000000000D10000-memory.dmp
memory/1520-19-0x0000000074B70000-0x000000007525E000-memory.dmp
memory/2876-10-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-11-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-12-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-13-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2876-14-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-16-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-18-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-9-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2876-20-0x0000000074B70000-0x000000007525E000-memory.dmp
memory/2876-21-0x0000000004720000-0x0000000004760000-memory.dmp
memory/2876-22-0x0000000074B70000-0x000000007525E000-memory.dmp
memory/2876-23-0x0000000004720000-0x0000000004760000-memory.dmp