Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 13:12
Static task
static1
Behavioral task
behavioral1
Sample
ORDEM DE COMPRA.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ORDEM DE COMPRA.exe
Resource
win10v2004-20240508-en
General
-
Target
ORDEM DE COMPRA.exe
-
Size
516KB
-
MD5
46dab257847ea9cfbbc77979323212c4
-
SHA1
8cbd33b3cf519807b2c986f7fbe3daae4175595f
-
SHA256
1f522609abaf12c6647c56b379cdf2c9263a845a6b4c93bac7111d0c27d68159
-
SHA512
ead6cefa6e39df40bdceed5dd6fb4dad3bad18d087f3d8f6d578c1e46236a32b2728e5e206b1aa7f1b6a63fa220cc87d0867be558895690000936cffd63c0dbe
-
SSDEEP
12288:PMYSxPCxJLpWDH0MVk6V8y8OY9xQCiGVb+r:0YSJCxpk3T09iCjVE
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.gbogboro.com - Port:
587 - Username:
[email protected] - Password:
Egoamaka@123
https://scratchdreams.tk
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4356-7-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Processes:
ORDEM DE COMPRA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ORDEM DE COMPRA.exe -
Processes:
ORDEM DE COMPRA.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths ORDEM DE COMPRA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ORDEM DE COMPRA.exe = "0" ORDEM DE COMPRA.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ORDEM DE COMPRA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation ORDEM DE COMPRA.exe -
Processes:
ORDEM DE COMPRA.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths ORDEM DE COMPRA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions ORDEM DE COMPRA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ORDEM DE COMPRA.exe = "0" ORDEM DE COMPRA.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe -
Processes:
ORDEM DE COMPRA.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ORDEM DE COMPRA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ORDEM DE COMPRA.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDEM DE COMPRA.exedescription pid process target process PID 1732 set thread context of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exemsbuild.exepid process 1468 powershell.exe 1468 powershell.exe 4356 msbuild.exe 4356 msbuild.exe 1468 powershell.exe 4356 msbuild.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ORDEM DE COMPRA.exepowershell.exemsbuild.exedescription pid process Token: SeDebugPrivilege 1732 ORDEM DE COMPRA.exe Token: SeDebugPrivilege 1468 powershell.exe Token: SeDebugPrivilege 4356 msbuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
ORDEM DE COMPRA.exedescription pid process target process PID 1732 wrote to memory of 1468 1732 ORDEM DE COMPRA.exe powershell.exe PID 1732 wrote to memory of 1468 1732 ORDEM DE COMPRA.exe powershell.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 4356 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 1148 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 1148 1732 ORDEM DE COMPRA.exe msbuild.exe PID 1732 wrote to memory of 1148 1732 ORDEM DE COMPRA.exe msbuild.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
ORDEM DE COMPRA.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ORDEM DE COMPRA.exe -
outlook_office_path 1 IoCs
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe -
outlook_win_path 1 IoCs
Processes:
msbuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msbuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDEM DE COMPRA.exe"C:\Users\Admin\AppData\Local\Temp\ORDEM DE COMPRA.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDEM DE COMPRA.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qjblkd1d.0m3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1468-23-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmpFilesize
10.8MB
-
memory/1468-9-0x00007FFB552B3000-0x00007FFB552B5000-memory.dmpFilesize
8KB
-
memory/1468-19-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmpFilesize
10.8MB
-
memory/1468-26-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmpFilesize
10.8MB
-
memory/1468-22-0x000001A5FFF70000-0x000001A5FFF92000-memory.dmpFilesize
136KB
-
memory/1732-27-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmpFilesize
10.8MB
-
memory/1732-5-0x000001CBF5D70000-0x000001CBF5D76000-memory.dmpFilesize
24KB
-
memory/1732-2-0x000001CBF7620000-0x000001CBF7696000-memory.dmpFilesize
472KB
-
memory/1732-4-0x00007FFB552B0000-0x00007FFB55D71000-memory.dmpFilesize
10.8MB
-
memory/1732-1-0x00007FFB552B3000-0x00007FFB552B5000-memory.dmpFilesize
8KB
-
memory/1732-0-0x000001CBF59D0000-0x000001CBF59E0000-memory.dmpFilesize
64KB
-
memory/1732-3-0x000001CBF5D90000-0x000001CBF5DAE000-memory.dmpFilesize
120KB
-
memory/1732-6-0x000001CBF7EB0000-0x000001CBF7F2A000-memory.dmpFilesize
488KB
-
memory/4356-32-0x0000000005020000-0x000000000502A000-memory.dmpFilesize
40KB
-
memory/4356-7-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/4356-21-0x0000000005040000-0x00000000050DC000-memory.dmpFilesize
624KB
-
memory/4356-8-0x0000000074AFE000-0x0000000074AFF000-memory.dmpFilesize
4KB
-
memory/4356-28-0x0000000074AFE000-0x0000000074AFF000-memory.dmpFilesize
4KB
-
memory/4356-29-0x0000000000DF0000-0x0000000000E40000-memory.dmpFilesize
320KB
-
memory/4356-30-0x00000000062F0000-0x00000000064B2000-memory.dmpFilesize
1.8MB
-
memory/4356-31-0x00000000061C0000-0x0000000006252000-memory.dmpFilesize
584KB
-
memory/4356-20-0x00000000055F0000-0x0000000005B94000-memory.dmpFilesize
5.6MB