Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:08
Static task
static1
Behavioral task
behavioral1
Sample
d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
Resource
win10v2004-20240412-en
General
-
Target
d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
-
Size
464KB
-
MD5
1f7ac06f56077381b5097cde5c4cab87
-
SHA1
5738220c5460de988a1b30a3a9532fd226d9d3b8
-
SHA256
d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb
-
SHA512
2426d1466ec06f3e67e3fdf7f01eb79cc11e46711e955e73a28d43dc5452881bfbd62d189c082d6b6224b58ab9f51a723d58688883c61ee7703cfcfeed0f2f3f
-
SSDEEP
12288:vCXFQTAajA6n1tiGSZ4EidlIw8mfcMAAAAAAAAAAMA5AAAAAAAAAAAAAAAAAAAAP:vqFQTAajA4fo4EiIw8ccMAAAAAAAAAAd
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
instalacionestasende.com - Port:
25 - Username:
[email protected] - Password:
VzX79@6v - Email To:
[email protected]
https://scratchdreams.tk
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/3484-8-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 30 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3444 set thread context of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3484 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3484 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3444 wrote to memory of 3484 3444 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 95 PID 3484 wrote to memory of 3864 3484 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 96 PID 3484 wrote to memory of 3864 3484 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 96 PID 3484 wrote to memory of 3864 3484 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe 96 PID 3864 wrote to memory of 1664 3864 cmd.exe 98 PID 3864 wrote to memory of 1664 3864 cmd.exe 98 PID 3864 wrote to memory of 1664 3864 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:1664
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe.log
Filesize706B
MD5f8bcaf312de8591707436c1dcebba8e4
SHA1a1269828e5f644601622f4a7a611aec8f2eda0b2
SHA256f0f5a90777c70cdceea22bd66b33c1703a318acc45cb012d0b01585a1ac12b29
SHA5123a714f5950584abbc94a27bbd4623bfc5acb1135c8c9fca4d74e70c8481b71ace7dbc1dfbf101dd07c76a050acfb4852f31dd57fc7ae196382336c5edc9e6413