Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 02:09

General

  • Target

    301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522.exe

  • Size

    623KB

  • MD5

    90a34e7d570fa7c219eb5f1f193611ba

  • SHA1

    0d5d3955b04174b8f21c7bdd8d80ff21507e409c

  • SHA256

    301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522

  • SHA512

    75177b9ddf945e4dc46fb20174385faddfc569ea99cc095d1e1f9f4a96b9accc7dfcc1f6a1bd15d5740438e8ef63784ce870dfb3ea8d8c5387cc652324ace955

  • SSDEEP

    12288:npahc5sgNxUQx/rYquAfVCto8UHv/9EeRxDVl5nX:nZsgbFkq2tNUHDFVXX

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

https://scratchdreams.tk

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables with potential process hoocking 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522.exe
    "C:\Users\Admin\AppData\Local\Temp\301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522.exe
      "C:\Users\Admin\AppData\Local\Temp\301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4548

Network

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522.exe.log
    Filesize

    706B

    MD5

    f8bcaf312de8591707436c1dcebba8e4

    SHA1

    a1269828e5f644601622f4a7a611aec8f2eda0b2

    SHA256

    f0f5a90777c70cdceea22bd66b33c1703a318acc45cb012d0b01585a1ac12b29

    SHA512

    3a714f5950584abbc94a27bbd4623bfc5acb1135c8c9fca4d74e70c8481b71ace7dbc1dfbf101dd07c76a050acfb4852f31dd57fc7ae196382336c5edc9e6413

  • memory/1080-4-0x00000000059C0000-0x0000000005F64000-memory.dmp
    Filesize

    5.6MB

  • memory/1080-5-0x0000000005410000-0x00000000054A2000-memory.dmp
    Filesize

    584KB

  • memory/1080-1-0x0000000075150000-0x0000000075900000-memory.dmp
    Filesize

    7.7MB

  • memory/1080-0-0x0000000000880000-0x0000000000920000-memory.dmp
    Filesize

    640KB

  • memory/1080-11-0x0000000075150000-0x0000000075900000-memory.dmp
    Filesize

    7.7MB

  • memory/1080-6-0x0000000005550000-0x00000000055EC000-memory.dmp
    Filesize

    624KB

  • memory/1080-7-0x0000000005390000-0x0000000005398000-memory.dmp
    Filesize

    32KB

  • memory/1080-2-0x0000000002D90000-0x0000000002DE4000-memory.dmp
    Filesize

    336KB

  • memory/1080-3-0x0000000005400000-0x0000000005410000-memory.dmp
    Filesize

    64KB

  • memory/4548-13-0x0000000000370000-0x0000000000396000-memory.dmp
    Filesize

    152KB

  • memory/4548-12-0x0000000075150000-0x0000000075900000-memory.dmp
    Filesize

    7.7MB

  • memory/4548-14-0x0000000004F50000-0x0000000004F60000-memory.dmp
    Filesize

    64KB

  • memory/4548-15-0x0000000075150000-0x0000000075900000-memory.dmp
    Filesize

    7.7MB

  • memory/4548-16-0x0000000004F50000-0x0000000004F60000-memory.dmp
    Filesize

    64KB

  • memory/4548-17-0x0000000006000000-0x0000000006050000-memory.dmp
    Filesize

    320KB

  • memory/4548-18-0x0000000006220000-0x00000000063E2000-memory.dmp
    Filesize

    1.8MB

  • memory/4548-19-0x00000000060A0000-0x00000000060AA000-memory.dmp
    Filesize

    40KB