Analysis
-
max time kernel
119s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 11:44
Static task
static1
Behavioral task
behavioral1
Sample
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe
Resource
win10v2004-20240426-en
General
-
Target
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe
-
Size
607KB
-
MD5
ac78d040e052a079b89378bacbb2d5df
-
SHA1
fa96990e3825fc42a17745c3232333e6cff537e2
-
SHA256
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2
-
SHA512
70b7497f4272841f629764763112d0b28e1300cc91f66d044a081f4d47c7487ede52e4cf9fbfc1fa69ce00a9aef0bab005964320c63ae301594967db62f86a8a
-
SSDEEP
12288:fRHI0ZuTGPV811Iyu2Cxt/zfBvpQtRBWXyWe635+urxdoT9:fpZuSPiA1FzHsPO7e0+m6Z
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.gbogboro.com - Port:
587 - Username:
[email protected] - Password:
Egoamaka@123
https://scratchdreams.tk
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2508-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2508-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2508-12-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2508-16-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2508-15-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exedescription pid process target process PID 1664 set thread context of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AddInProcess32.exepid process 2508 AddInProcess32.exe 2508 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AddInProcess32.exedescription pid process Token: SeDebugPrivilege 2508 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exedescription pid process target process PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2508 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe AddInProcess32.exe PID 1664 wrote to memory of 2556 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe WerFault.exe PID 1664 wrote to memory of 2556 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe WerFault.exe PID 1664 wrote to memory of 2556 1664 9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe -
outlook_win_path 1 IoCs
Processes:
AddInProcess32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe"C:\Users\Admin\AppData\Local\Temp\9e5762b0fb425b6e9b9e886e9f7c517d02928b3d355755fcf4e28a2ac8ceefa2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2508 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1664 -s 6842⤵PID:2556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-0-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmpFilesize
4KB
-
memory/1664-1-0x0000000000810000-0x0000000000836000-memory.dmpFilesize
152KB
-
memory/1664-2-0x000007FEF5A40000-0x000007FEF642C000-memory.dmpFilesize
9.9MB
-
memory/1664-3-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/1664-4-0x0000000000720000-0x000000000079A000-memory.dmpFilesize
488KB
-
memory/1664-20-0x000007FEF5A40000-0x000007FEF642C000-memory.dmpFilesize
9.9MB
-
memory/1664-19-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmpFilesize
4KB
-
memory/2508-9-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2508-7-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-12-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-16-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-15-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-17-0x00000000746DE000-0x00000000746DF000-memory.dmpFilesize
4KB
-
memory/2508-18-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB
-
memory/2508-10-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-5-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2508-21-0x00000000746D0000-0x0000000074DBE000-memory.dmpFilesize
6.9MB