Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
Project 4302021KSA.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Project 4302021KSA.exe
Resource
win10v2004-20240412-en
General
-
Target
Project 4302021KSA.exe
-
Size
1.3MB
-
MD5
75dd111b19ce0b8dfaecccf2e12f44f9
-
SHA1
c16c31f8f80ea50065e39808bcdf7f4e8535497a
-
SHA256
55bd833636eeb445bd7e1ef5d23b5ce1a5bc26a3e6de305f37b8e285cec68443
-
SHA512
55b190fad095d1dd07d6f9104c15a2a9f36a0e1877ab68205f8adc781fc4fa2344a60774f55c5fa306eaa4a7d41f8d710b4e559ad40d8c225d10dfe76a3fc316
-
SSDEEP
24576:KoLemDiufx8DgMfx8Dgf49gsTfB5fihpQEGqscZCHLL:KoL9DT58DgM58DgfKg0PqQmZCr
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1344-12-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1344-14-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1344-17-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1344-19-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger behavioral1/memory/1344-21-0x0000000000400000-0x0000000000424000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 8 freegeoip.app 9 freegeoip.app -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Project 4302021KSA.exedescription pid process target process PID 2812 set thread context of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1952 1344 WerFault.exe Project 4302021KSA.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Project 4302021KSA.exepid process 1344 Project 4302021KSA.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Project 4302021KSA.exedescription pid process Token: SeDebugPrivilege 1344 Project 4302021KSA.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Project 4302021KSA.exeProject 4302021KSA.exedescription pid process target process PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 2812 wrote to memory of 1344 2812 Project 4302021KSA.exe Project 4302021KSA.exe PID 1344 wrote to memory of 1952 1344 Project 4302021KSA.exe WerFault.exe PID 1344 wrote to memory of 1952 1344 Project 4302021KSA.exe WerFault.exe PID 1344 wrote to memory of 1952 1344 Project 4302021KSA.exe WerFault.exe PID 1344 wrote to memory of 1952 1344 Project 4302021KSA.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe"C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe"C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 16163⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-21-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1344-17-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1344-12-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1344-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1344-14-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1344-26-0x0000000004270000-0x00000000042B0000-memory.dmpFilesize
256KB
-
memory/1344-25-0x0000000074280000-0x000000007496E000-memory.dmpFilesize
6.9MB
-
memory/1344-24-0x0000000004270000-0x00000000042B0000-memory.dmpFilesize
256KB
-
memory/1344-8-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1344-10-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1344-23-0x0000000074280000-0x000000007496E000-memory.dmpFilesize
6.9MB
-
memory/1344-19-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2812-4-0x0000000074280000-0x000000007496E000-memory.dmpFilesize
6.9MB
-
memory/2812-3-0x0000000000650000-0x0000000000662000-memory.dmpFilesize
72KB
-
memory/2812-0-0x0000000000270000-0x00000000003C6000-memory.dmpFilesize
1.3MB
-
memory/2812-1-0x0000000074280000-0x000000007496E000-memory.dmpFilesize
6.9MB
-
memory/2812-22-0x0000000074280000-0x000000007496E000-memory.dmpFilesize
6.9MB
-
memory/2812-2-0x0000000004380000-0x00000000043C0000-memory.dmpFilesize
256KB
-
memory/2812-7-0x0000000000950000-0x0000000000974000-memory.dmpFilesize
144KB
-
memory/2812-6-0x00000000094A0000-0x000000000952C000-memory.dmpFilesize
560KB
-
memory/2812-5-0x0000000004380000-0x00000000043C0000-memory.dmpFilesize
256KB