Analysis
-
max time kernel
19s -
max time network
28s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
11/06/2024, 12:53
General
-
Target
CTM USD28600.exe
-
Size
331KB
-
MD5
d5fc299eb2708903f3132b09af1ebdbb
-
SHA1
003efab8f439255094d2b8c63e096682509afb4f
-
SHA256
613308a9ef0289f190c7f9ba6dac4209a93fcbda05d893716a6b40e6167102fd
-
SHA512
e8577a48ffee301f2eebc13e2b784d65791dc477d1ff2f0fb761cc0a8d999eef024e8c37b74d070de49fb4538b32227e594e446c19ed4dde85e2f1af29326f20
-
SSDEEP
6144:ju9K5wR27SQn21/bFSj85xl/B2XiYVDc6q40YBgjMRbtvs:ju9K5d7SA2jS0xviiYSfwM
Score
10/10
Malware Config
Extracted
Family
snakekeylogger
Credentials
Protocol: smtp- Host:
valleycountysar.org - Port:
26 - Username:
[email protected] - Password:
~{w6R&q({me_ - Email To:
[email protected]
C2
http://103.130.147.85
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CTM USD28600.exe"C:\Users\Admin\AppData\Local\Temp\CTM USD28600.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CTM USD28600.exe"C:\Users\Admin\AppData\Local\Temp\CTM USD28600.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
360KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
336KB
-
Filesize
6.9MB