Analysis

  • max time kernel
    115s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 17:47

General

  • Target

    ORDEN DE COMPRA URGENTE pdf.exe

  • Size

    503KB

  • MD5

    41604cd16b04a9ddb71e24c12cef8e1a

  • SHA1

    c62dd24270afc456f5c5f1a8ebc3a4d9c20d18c6

  • SHA256

    8f333d09b79c5f45f7724ef1eda6e0b811a7d2a8268f0580cf2a1b5d5e40b1de

  • SHA512

    3f6bf8b3f1e5186ecc3deb2291ab653c248f26ddaf0d56ea47c497021ac76655941d3a647e5fde9d55c805a7ff4a0ea12cf1da7e26d919e1f5d36c29b2b7a1e8

  • SSDEEP

    12288:SO/f2e5J2aFOh67jTrmRLFonFXz3UVbMUOPYI:1Uh4jfCTbMnn

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    mail.gbogboro.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Lovelove@123
C2

https://scratchdreams.tk

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
        PID:1652
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        2⤵
          PID:1108
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:3404
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
          2⤵
            PID:4316
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4372,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:8
          1⤵
            PID:3848

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3404-8-0x00000000747A0000-0x0000000074F50000-memory.dmp

            Filesize

            7.7MB

          • memory/3404-10-0x00000000747AE000-0x00000000747AF000-memory.dmp

            Filesize

            4KB

          • memory/3404-15-0x00000000064F0000-0x00000000064FA000-memory.dmp

            Filesize

            40KB

          • memory/3404-14-0x0000000006580000-0x0000000006612000-memory.dmp

            Filesize

            584KB

          • memory/3404-13-0x00000000066B0000-0x0000000006872000-memory.dmp

            Filesize

            1.8MB

          • memory/3404-5-0x00000000747AE000-0x00000000747AF000-memory.dmp

            Filesize

            4KB

          • memory/3404-12-0x0000000006490000-0x00000000064E0000-memory.dmp

            Filesize

            320KB

          • memory/3404-6-0x00000000057D0000-0x0000000005D74000-memory.dmp

            Filesize

            5.6MB

          • memory/3404-4-0x0000000000400000-0x0000000000426000-memory.dmp

            Filesize

            152KB

          • memory/3404-11-0x00000000747A0000-0x0000000074F50000-memory.dmp

            Filesize

            7.7MB

          • memory/3404-7-0x00000000052C0000-0x000000000535C000-memory.dmp

            Filesize

            624KB

          • memory/4584-9-0x00007FFCAD330000-0x00007FFCADDF1000-memory.dmp

            Filesize

            10.8MB

          • memory/4584-1-0x00007FFCAD333000-0x00007FFCAD335000-memory.dmp

            Filesize

            8KB

          • memory/4584-0-0x000001FE8C550000-0x000001FE8C55A000-memory.dmp

            Filesize

            40KB

          • memory/4584-3-0x00007FFCAD330000-0x00007FFCADDF1000-memory.dmp

            Filesize

            10.8MB

          • memory/4584-2-0x000001FE8E180000-0x000001FE8E1FC000-memory.dmp

            Filesize

            496KB