Analysis
- max time kernel
133s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
03/07/2024, 22:03
General
- Target Contract.exe
- Size 563KB
- Sample240703-1yb2wszdpf
- SHA256 f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.speedhouseoman.com
-
Port
587
-
Username
-
Password
SpH@0084
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Contract.exe"C:\Users\Admin\AppData\Local\Temp\Contract.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vgTSRopQheAdCk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vgTSRopQheAdCk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD2A.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Contract.exe"C:\Users\Admin\AppData\Local\Temp\Contract.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,16856304285138459032,14480077487839828721,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_edyrww2p.ohb.ps1
tmpD2A.tmp
memory/1284-33-0x0000000005810000-0x0000000005B64000-memory.dmp
memory/1284-24-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/1284-22-0x0000000004F00000-0x0000000004F22000-memory.dmp
memory/1284-64-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/1284-61-0x0000000007410000-0x0000000007418000-memory.dmp
memory/1284-60-0x0000000007430000-0x000000000744A000-memory.dmp
memory/1284-59-0x0000000007330000-0x0000000007344000-memory.dmp
memory/1284-58-0x0000000007320000-0x000000000732E000-memory.dmp
memory/1284-57-0x00000000072F0000-0x0000000007301000-memory.dmp
memory/1284-15-0x0000000004820000-0x0000000004856000-memory.dmp
memory/1284-16-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/1284-19-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/1284-18-0x0000000004FA0000-0x00000000055C8000-memory.dmp
memory/1284-20-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/1284-56-0x0000000007370000-0x0000000007406000-memory.dmp
memory/1284-55-0x0000000007160000-0x000000000716A000-memory.dmp
memory/1284-25-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/1284-54-0x00000000070F0000-0x000000000710A000-memory.dmp
memory/1284-53-0x0000000007730000-0x0000000007DAA000-memory.dmp
memory/1284-52-0x0000000006FD0000-0x0000000007073000-memory.dmp
memory/1284-51-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/1284-41-0x0000000072A60000-0x0000000072AAC000-memory.dmp
memory/1284-40-0x0000000006D90000-0x0000000006DC2000-memory.dmp
memory/1284-39-0x0000000005E80000-0x0000000005ECC000-memory.dmp
memory/1284-38-0x0000000005DB0000-0x0000000005DCE000-memory.dmp
memory/3232-9-0x0000000005220000-0x000000000522C000-memory.dmp
memory/3232-5-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/3232-3-0x0000000005820000-0x00000000058B2000-memory.dmp
memory/3232-1-0x0000000000D20000-0x0000000000DB2000-memory.dmp
memory/3232-27-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/3232-8-0x0000000005A40000-0x0000000005A48000-memory.dmp
memory/3232-6-0x0000000005AB0000-0x0000000005B4C000-memory.dmp
memory/3232-4-0x00000000057C0000-0x00000000057CA000-memory.dmp
memory/3232-0-0x000000007539E000-0x000000007539F000-memory.dmp
memory/3232-10-0x0000000006CC0000-0x0000000006D28000-memory.dmp
memory/3232-2-0x0000000005DD0000-0x0000000006374000-memory.dmp
memory/3232-7-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/4680-21-0x0000000000400000-0x0000000000426000-memory.dmp
memory/4680-26-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/4680-65-0x0000000006960000-0x00000000069B0000-memory.dmp
memory/4680-66-0x0000000006B80000-0x0000000006D42000-memory.dmp
memory/4680-67-0x0000000075390000-0x0000000075B40000-memory.dmp