Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 05:28
Static task
static1
Behavioral task
behavioral1
Sample
ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe
Resource
win10v2004-20240508-en
General
-
Target
ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe
-
Size
607KB
-
MD5
ac78d040e052a079b89378bacbb2d5df
-
SHA1
fa96990e3825fc42a17745c3232333e6cff537e2
-
SHA256
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2
-
SHA512
70b7497f4272841f629764763112d0b28e1300cc91f66d044a081f4d47c7487ede52e4cf9fbfc1fa69ce00a9aef0bab005964320c63ae301594967db62f86a8a
-
SSDEEP
12288:fRHI0ZuTGPV811Iyu2Cxt/zfBvpQtRBWXyWe635+urxdoT9:fpZuSPiA1FzHsPO7e0+m6Z
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.gbogboro.com - Port:
587 - Username:
[email protected] - Password:
Egoamaka@123
https://scratchdreams.tk
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/220-5-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ПЛАТЕЖНЫЙ ДОКУМЕНТ.exedescription pid process target process PID 4296 set thread context of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AddInProcess32.exepid process 220 AddInProcess32.exe 220 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AddInProcess32.exedescription pid process Token: SeDebugPrivilege 220 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ПЛАТЕЖНЫЙ ДОКУМЕНТ.exedescription pid process target process PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe PID 4296 wrote to memory of 220 4296 ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe AddInProcess32.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe"C:\Users\Admin\AppData\Local\Temp\ПЛАТЕЖНЫЙ ДОКУМЕНТ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/220-12-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB
-
memory/220-13-0x0000000001570000-0x00000000015C0000-memory.dmpFilesize
320KB
-
memory/220-8-0x0000000005920000-0x00000000059BC000-memory.dmpFilesize
624KB
-
memory/220-16-0x0000000005EC0000-0x0000000005ECA000-memory.dmpFilesize
40KB
-
memory/220-9-0x0000000074D30000-0x00000000754E0000-memory.dmpFilesize
7.7MB
-
memory/220-5-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/220-6-0x0000000074D3E000-0x0000000074D3F000-memory.dmpFilesize
4KB
-
memory/220-15-0x0000000006AE0000-0x0000000006B72000-memory.dmpFilesize
584KB
-
memory/220-14-0x0000000006C10000-0x0000000006DD2000-memory.dmpFilesize
1.8MB
-
memory/220-11-0x0000000074D3E000-0x0000000074D3F000-memory.dmpFilesize
4KB
-
memory/220-7-0x0000000005ED0000-0x0000000006474000-memory.dmpFilesize
5.6MB
-
memory/4296-4-0x0000027C60050000-0x0000027C600CA000-memory.dmpFilesize
488KB
-
memory/4296-0-0x0000027C45920000-0x0000027C45946000-memory.dmpFilesize
152KB
-
memory/4296-1-0x00007FFF5E983000-0x00007FFF5E985000-memory.dmpFilesize
8KB
-
memory/4296-2-0x00007FFF5E980000-0x00007FFF5F441000-memory.dmpFilesize
10.8MB
-
memory/4296-10-0x00007FFF5E980000-0x00007FFF5F441000-memory.dmpFilesize
10.8MB
-
memory/4296-3-0x0000027C47600000-0x0000027C47606000-memory.dmpFilesize
24KB