Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
04/06/2024, 02:11
General
- Target f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe
- Size 612KB
- Sample240604-cmbd8ahg71
- SHA256 f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.stpgig.com
-
Port
587
-
Username
-
Password
Stpgig#Login21
-
https://scratchdreams.tk
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- Detects executables with potential process hoocking 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe"C:\Users\Admin\AppData\Local\Temp\f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uzwgZUY.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uzwgZUY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7FFD.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe"C:\Users\Admin\AppData\Local\Temp\f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
f801b09d24cdce0bbcbe6787af8881bf78a7d3e7dd807610d7f0766505d9a380.exe.log
__PSScriptPolicyTest_h0un54r4.d1b.ps1
tmp7FFD.tmp
memory/2724-53-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/2724-29-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2724-36-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3248-54-0x0000000007A70000-0x0000000007B13000-memory.dmp
memory/3248-38-0x0000000006880000-0x000000000689E000-memory.dmp
memory/3248-66-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3248-63-0x0000000007EC0000-0x0000000007EC8000-memory.dmp
memory/3248-62-0x0000000007EE0000-0x0000000007EFA000-memory.dmp
memory/3248-15-0x0000000002FA0000-0x0000000002FD6000-memory.dmp
memory/3248-16-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3248-17-0x0000000005A20000-0x0000000006048000-memory.dmp
memory/3248-61-0x0000000007DE0000-0x0000000007DF4000-memory.dmp
memory/3248-18-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3248-20-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3248-21-0x00000000058B0000-0x00000000058D2000-memory.dmp
memory/3248-23-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/3248-60-0x0000000007DD0000-0x0000000007DDE000-memory.dmp
memory/3248-35-0x0000000006290000-0x00000000065E4000-memory.dmp
memory/3248-59-0x0000000007DA0000-0x0000000007DB1000-memory.dmp
memory/3248-58-0x0000000007E20000-0x0000000007EB6000-memory.dmp
memory/3248-57-0x0000000007C10000-0x0000000007C1A000-memory.dmp
memory/3248-22-0x0000000006100000-0x0000000006166000-memory.dmp
memory/3248-56-0x0000000007BA0000-0x0000000007BBA000-memory.dmp
memory/3248-39-0x00000000068B0000-0x00000000068FC000-memory.dmp
memory/3248-55-0x00000000081F0000-0x000000000886A000-memory.dmp
memory/3248-41-0x0000000007810000-0x0000000007842000-memory.dmp
memory/3248-42-0x00000000716B0000-0x00000000716FC000-memory.dmp
memory/3248-52-0x0000000007A50000-0x0000000007A6E000-memory.dmp
memory/3332-0-0x000000007512E000-0x000000007512F000-memory.dmp
memory/3332-1-0x0000000000D40000-0x0000000000DDE000-memory.dmp
memory/3332-2-0x0000000005CC0000-0x0000000006264000-memory.dmp
memory/3332-7-0x0000000005CB0000-0x0000000005CBE000-memory.dmp
memory/3332-3-0x00000000057B0000-0x0000000005842000-memory.dmp
memory/3332-37-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3332-4-0x0000000005960000-0x000000000596A000-memory.dmp
memory/3332-5-0x0000000075120000-0x00000000758D0000-memory.dmp
memory/3332-6-0x0000000005C70000-0x0000000005C88000-memory.dmp
memory/3332-10-0x000000000DA80000-0x000000000DB1C000-memory.dmp
memory/3332-9-0x000000000A970000-0x000000000A9D8000-memory.dmp
memory/3332-8-0x0000000006A60000-0x0000000006A74000-memory.dmp