Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
04-04-2024 01:57
General
-
Target
759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef.exe
-
Size
1.2MB
-
MD5
f4c48bbe6cde1a682287a9753ded114c
-
SHA1
c8fdfaeb6ab3cbb81b4a67e1f42c55c0b9b37ae8
-
SHA256
759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef
-
SHA512
7102455b6983167366e5d8a72c3fcd219312c89ae1eba825014d08d9c18dbdf418b4187f3954957d9497634b30f840420cb7b5a841adcc6561b1fd3ba4e51f55
-
SSDEEP
24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aIw7u9tOtIjVnx4Zpsh:QTvC/MTQYxsWR7aI99tOtIjRa
Malware Config
Extracted
snakekeylogger
https://scratchdreams.tk
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 36 IoCs
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
-
Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
-
Detects executables with potential process hoocking 33 IoCs
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef.exe"C:\Users\Admin\AppData\Local\Temp\759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\759b8eeb19d732283ec91e12f01836653eb69f384fb2cab4072e67dcac4748ef.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\directory\name.exe"4⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD569f265b76616f1ebd2fea2383159d1d5
SHA11793d620ff21de7d330847f690315f62c36e4fa2
SHA256338b5750c5364d706fe277c65dd0ed6a2588818bcb899a70cfc749e7f3e6311b
SHA512d2425b28bd80f511dd7332869e45570e820c0943cf97711e92a8756f9161709fb480994ad99aa6196126756d125657997b6148780a01e8257533cd05c72f99f5
-
Filesize
9KB
MD5dcdf3cfeda05cfc27c0b2bd0f778f224
SHA19d4f9401ead6d0156c5800250504d72231dfe632
SHA2563aedfcf427627d9fa5979687fcb4d220539e54eeb4756f3409b01491afbda5a2
SHA512660785a28292b588d2ac53bb36d7c7f116b59643aaec8d454a50047cc1313ce138203d8aa785b2b6aab3551283752311ebadc4b3118a450af73d181fe090ced3
-
Filesize
29KB
MD5fc4f122ecc2dab569ae91a9b0443b2ef
SHA1cda785611b96033085d6753d1c29c7e116bbe5f7
SHA256703ce1ff569d222752520feb296a1f0d16f5eb0b22709b7135967d64ad07fa60
SHA512614cc46d581b0f3b15ab7610e19d0e84c8a20d080a4682970d3f163e553fb8fe305211de13c7f910b35c878c241b54d1543d3b927f13da9756dae0db39b03048
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
224KB
MD5fc08bdf2f36992f8cdb2f188710805b8
SHA110437e27f96b61e494e5788807819a15e2401187
SHA2568bbb10084fbe292e3f09bd1113ee832028b1dad995f563e96c98a7da4433bef3
SHA512e30f9ce9008c4c0003d225e3532040e10558ac90c0cf84b96672815cb52c2f4ee659f26acb287d50b65433e4f435bf9b24e16cea06f1fa9f5ff674e4f5cfaa3b
-
Filesize
106.2MB
MD566545f575e99dd22778fb2e0d44bb726
SHA1d61ac78fb650c3b00a69b5f250fe9b2f1c7c4935
SHA25637e856954aea172217466399c708f5d0134ef37128bde28f6db657ac6096d3d2
SHA51257ddb2c92cd400388f3bcf42f8d0587483b9bfd10bf4620842db7b3cf45e24a40c1e56c14d971aca3dce74b39102d993cd10535097020289a817f6891704f9ab
-
Filesize
16KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
232KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
224KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
244KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
244KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
244KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
40KB