Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 06:14
Behavioral task
behavioral1
Sample
Цитата.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Цитата.exe
Resource
win10v2004-20240704-en
General
-
Target
Цитата.exe
-
Size
630KB
-
MD5
8305c265914ce059abaaa2052f8f92eb
-
SHA1
058685c06b39d568c8ac14834605e2b322c6b5d1
-
SHA256
943d1c268a4801187c975474c8e50695e1ba90149cd76daefdc8db9fae9e908c
-
SHA512
0df7a5591a1964a56b9060bf2a3cbccbd37f29a163f1659af0d32de7953c46d3977560b370f0f7b37632679e1af5760ddf9036891e2405291ea9db33d0067ba3
-
SSDEEP
12288:NYV6MorX7qzuC3QHO9FQVHPF51jgczxEv0x/w3hD9dVLUD2z5bV:iBXu9HGaVHUE/ghJdSaVbV
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7369383080:AAHZ3-eOPNC8dmeokZayL5k2b8wsqK_6ziI/sendMessage?chat_id=6485182959
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 32 IoCs
Processes:
resource yara_rule behavioral2/memory/1704-34-0x0000000005510000-0x000000000554A000-memory.dmp family_snakekeylogger behavioral2/memory/1704-38-0x0000000005590000-0x00000000055C8000-memory.dmp family_snakekeylogger behavioral2/memory/1704-92-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-70-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-50-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-44-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-39-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-96-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-94-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-90-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-88-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-86-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-84-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-82-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-80-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-78-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-76-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-74-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-72-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-68-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-66-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-64-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-62-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-60-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-58-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-56-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-54-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-52-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-48-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-46-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-42-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger behavioral2/memory/1704-40-0x0000000005590000-0x00000000055C3000-memory.dmp family_snakekeylogger -
Processes:
resource yara_rule behavioral2/memory/2280-0-0x0000000000FB0000-0x0000000001117000-memory.dmp upx behavioral2/memory/1320-12-0x0000000000FB0000-0x0000000001117000-memory.dmp upx behavioral2/memory/2280-14-0x0000000000FB0000-0x0000000001117000-memory.dmp upx behavioral2/memory/1320-33-0x0000000000FB0000-0x0000000001117000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 checkip.dyndns.org -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2280-14-0x0000000000FB0000-0x0000000001117000-memory.dmp autoit_exe behavioral2/memory/1320-33-0x0000000000FB0000-0x0000000001117000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Цитата.exedescription pid process target process PID 1320 set thread context of 1704 1320 Цитата.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
RegSvcs.exepid process 1704 RegSvcs.exe 1704 RegSvcs.exe 1704 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Цитата.exeЦитата.exepid process 2280 Цитата.exe 1320 Цитата.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 1704 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Цитата.exeЦитата.exepid process 2280 Цитата.exe 2280 Цитата.exe 1320 Цитата.exe 1320 Цитата.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Цитата.exeЦитата.exepid process 2280 Цитата.exe 2280 Цитата.exe 1320 Цитата.exe 1320 Цитата.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Цитата.exeЦитата.exedescription pid process target process PID 2280 wrote to memory of 4876 2280 Цитата.exe RegSvcs.exe PID 2280 wrote to memory of 4876 2280 Цитата.exe RegSvcs.exe PID 2280 wrote to memory of 4876 2280 Цитата.exe RegSvcs.exe PID 2280 wrote to memory of 1320 2280 Цитата.exe Цитата.exe PID 2280 wrote to memory of 1320 2280 Цитата.exe Цитата.exe PID 2280 wrote to memory of 1320 2280 Цитата.exe Цитата.exe PID 1320 wrote to memory of 1704 1320 Цитата.exe RegSvcs.exe PID 1320 wrote to memory of 1704 1320 Цитата.exe RegSvcs.exe PID 1320 wrote to memory of 1704 1320 Цитата.exe RegSvcs.exe PID 1320 wrote to memory of 1704 1320 Цитата.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2494989678-839960665-2515455429-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Цитата.exe"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"2⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\Цитата.exe"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Цитата.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5b903ae682ace22a8090e01209b86fd7d
SHA1765e06f164ca06fbfdf5d9a33f2417eebd6f521d
SHA2565c521fd28f2ec2ff936134a5d9f6d5bbabe3551673b6e2d003ccefe7296a90d0
SHA5128242fee299862ad517d6a5e08889e893e44a2f9c2bc3f6c5b49e160b3578e4b91a6c2e617a6c7e61dac55c64fbb467c2cab7e4038fcbc9907798ef9d26cbec20
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e