Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/05/2024, 08:39
General
- Target PO 18291 - PO 18292.exe
- Size 567KB
- Sample240502-kknkrsfd83
- SHA256 4ffdb2ec820fcc5ab2bc290fba2917c75d7cc0620beeb8def7bcbe80c31e319a
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.ettehadco.com
-
Port
587
-
Username
-
Password
1S47f$kWB@2jAt&*R8NA
-
Email to
-
https://scratchdreams.tk
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 18291 - PO 18292.exe"C:\Users\Admin\AppData\Local\Temp\PO 18291 - PO 18292.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 18291 - PO 18292.exe"C:\Users\Admin\AppData\Local\Temp\PO 18291 - PO 18292.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/212-10-0x0000000000400000-0x0000000000426000-memory.dmp
memory/212-17-0x0000000006690000-0x0000000006852000-memory.dmp
memory/212-16-0x0000000006470000-0x00000000064C0000-memory.dmp
memory/212-15-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/212-14-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/212-11-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/956-8-0x0000000006BA0000-0x0000000006C08000-memory.dmp
memory/956-7-0x0000000005870000-0x0000000005886000-memory.dmp
memory/956-0-0x00000000752DE000-0x00000000752DF000-memory.dmp
memory/956-9-0x00000000091F0000-0x000000000928C000-memory.dmp
memory/956-6-0x0000000005630000-0x0000000005646000-memory.dmp
memory/956-5-0x00000000052E0000-0x00000000052EA000-memory.dmp
memory/956-13-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/956-4-0x00000000752D0000-0x0000000075A80000-memory.dmp
memory/956-3-0x0000000005230000-0x00000000052C2000-memory.dmp
memory/956-2-0x00000000058F0000-0x0000000005E94000-memory.dmp
memory/956-1-0x00000000007F0000-0x0000000000884000-memory.dmp