Analysis
-
max time kernel
92s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe
Resource
win10v2004-20240412-en
General
-
Target
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe
-
Size
333KB
-
MD5
b9d77c2410b5808b0e703395bb2907b7
-
SHA1
32e61029b0c3c25c56d5862068a3410a30a7670f
-
SHA256
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04
-
SHA512
c9c9110c22efd1c246f289396cc00c2e2cccef97e37914a73430fa08b7ea6e8b94b61c602ea82fde28e0e956894c01fbc44d9c105902684ac5b4b83bb3388614
-
SSDEEP
6144:mTyLMh4wMzywrWIq/2K7SBBMIARmCmwOE7bjVPJcfsduGAnx:LLMSewr9hBSRmp6BPJU7GAx
Malware Config
Extracted
snakekeylogger
http://varders.kozow.com:8081
http://aborters.duckdns.org:8081
http://anotherarmy.dns.army:8081
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3820-8-0x0000000000400000-0x000000000041C000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exedescription pid process target process PID 4732 set thread context of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exepid process 3820 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exedescription pid process Token: SeDebugPrivilege 3820 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.execmd.exedescription pid process target process PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 4732 wrote to memory of 3820 4732 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe PID 3820 wrote to memory of 2036 3820 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe cmd.exe PID 3820 wrote to memory of 2036 3820 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe cmd.exe PID 3820 wrote to memory of 2036 3820 7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe cmd.exe PID 2036 wrote to memory of 2432 2036 cmd.exe choice.exe PID 2036 wrote to memory of 2432 2036 cmd.exe choice.exe PID 2036 wrote to memory of 2432 2036 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe"C:\Users\Admin\AppData\Local\Temp\7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe"C:\Users\Admin\AppData\Local\Temp\7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7161d933e8ce30fc8824cb3532294905ca0582760a306254ad03318619519c04.exe.logFilesize
706B
MD52ef5ef69dadb8865b3d5b58c956077b8
SHA1af2d869bac00685c745652bbd8b3fe82829a8998
SHA256363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3
SHA51266d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3
-
memory/3820-8-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/3820-14-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/3820-13-0x00000000052F0000-0x0000000005300000-memory.dmpFilesize
64KB
-
memory/3820-12-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/4732-3-0x0000000005250000-0x00000000052E2000-memory.dmpFilesize
584KB
-
memory/4732-6-0x0000000005440000-0x00000000054DC000-memory.dmpFilesize
624KB
-
memory/4732-7-0x0000000005360000-0x0000000005368000-memory.dmpFilesize
32KB
-
memory/4732-5-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/4732-4-0x00000000052F0000-0x000000000533A000-memory.dmpFilesize
296KB
-
memory/4732-1-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/4732-11-0x0000000074E70000-0x0000000075620000-memory.dmpFilesize
7.7MB
-
memory/4732-2-0x0000000005800000-0x0000000005DA4000-memory.dmpFilesize
5.6MB
-
memory/4732-0-0x00000000007F0000-0x000000000084A000-memory.dmpFilesize
360KB