Analysis
-
max time kernel
34s -
max time network
46s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08-07-2024 09:13
Behavioral task
behavioral1
Sample
Τιμολόγιο.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Τιμολόγιο.exe
Resource
win10v2004-20240704-en
General
-
Target
Τιμολόγιο.exe
-
Size
635KB
-
MD5
1c421b07f985864fa94709528a9f2be8
-
SHA1
b96ce6f58e2d0e9215686bfad639e1389153e923
-
SHA256
388c6210072e3f84ad62a7a97691ea10199eeffaacd3b2b5932ad061a1c8f912
-
SHA512
78b9657372acee8f1268f431be22fc7576c46b89634802109b071948a859a3946d5b660abd40a16821c694429bc76a6c95f9a89f17c483a6ec9947d937140ced
-
SSDEEP
12288:DYV6MorX7qzuC3QHO9FQVHPF51jgc2PSAyl8oaLm2KmRkv+DQw3YiJ2zq:ABXu9HGaVH2K58ot2KmSmQw3YiYu
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7369383080:AAHZ3-eOPNC8dmeokZayL5k2b8wsqK_6ziI/sendMessage?chat_id=6485182959
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 33 IoCs
Processes:
resource yara_rule behavioral2/memory/2228-34-0x0000000002E60000-0x0000000002E9A000-memory.dmp family_snakekeylogger behavioral2/memory/2228-37-0x0000000005460000-0x0000000005498000-memory.dmp family_snakekeylogger behavioral2/memory/2228-39-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-65-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-79-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-97-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-95-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-93-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-91-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-89-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-87-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-85-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-83-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-81-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-78-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-75-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-73-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-71-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-70-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-67-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-61-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-60-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-57-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-55-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-51-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-47-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-45-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-43-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-64-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-53-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-38-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-50-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger behavioral2/memory/2228-41-0x0000000005460000-0x0000000005493000-memory.dmp family_snakekeylogger -
Processes:
resource yara_rule behavioral2/memory/1144-0-0x00000000001D0000-0x000000000033B000-memory.dmp upx behavioral2/memory/4528-12-0x00000000001D0000-0x000000000033B000-memory.dmp upx behavioral2/memory/1144-14-0x00000000001D0000-0x000000000033B000-memory.dmp upx behavioral2/memory/4528-32-0x00000000001D0000-0x000000000033B000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 checkip.dyndns.org -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1144-14-0x00000000001D0000-0x000000000033B000-memory.dmp autoit_exe behavioral2/memory/4528-32-0x00000000001D0000-0x000000000033B000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Τιμολόγιο.exedescription pid process target process PID 4528 set thread context of 2228 4528 Τιμολόγιο.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2228 RegSvcs.exe 2228 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Τιμολόγιο.exeΤιμολόγιο.exepid process 1144 Τιμολόγιο.exe 4528 Τιμολόγιο.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2228 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Τιμολόγιο.exeΤιμολόγιο.exepid process 1144 Τιμολόγιο.exe 1144 Τιμολόγιο.exe 1144 Τιμολόγιο.exe 4528 Τιμολόγιο.exe 4528 Τιμολόγιο.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
Τιμολόγιο.exeΤιμολόγιο.exepid process 1144 Τιμολόγιο.exe 1144 Τιμολόγιο.exe 1144 Τιμολόγιο.exe 4528 Τιμολόγιο.exe 4528 Τιμολόγιο.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Τιμολόγιο.exeΤιμολόγιο.exedescription pid process target process PID 1144 wrote to memory of 1388 1144 Τιμολόγιο.exe RegSvcs.exe PID 1144 wrote to memory of 1388 1144 Τιμολόγιο.exe RegSvcs.exe PID 1144 wrote to memory of 1388 1144 Τιμολόγιο.exe RegSvcs.exe PID 1144 wrote to memory of 4528 1144 Τιμολόγιο.exe Τιμολόγιο.exe PID 1144 wrote to memory of 4528 1144 Τιμολόγιο.exe Τιμολόγιο.exe PID 1144 wrote to memory of 4528 1144 Τιμολόγιο.exe Τιμολόγιο.exe PID 4528 wrote to memory of 2228 4528 Τιμολόγιο.exe RegSvcs.exe PID 4528 wrote to memory of 2228 4528 Τιμολόγιο.exe RegSvcs.exe PID 4528 wrote to memory of 2228 4528 Τιμολόγιο.exe RegSvcs.exe PID 4528 wrote to memory of 2228 4528 Τιμολόγιο.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Τιμολόγιο.exe"C:\Users\Admin\AppData\Local\Temp\Τιμολόγιο.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Τιμολόγιο.exe"2⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\Τιμολόγιο.exe"C:\Users\Admin\AppData\Local\Temp\Τιμολόγιο.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Τιμολόγιο.exe"3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5557a8104bfefc59ca420b4c47f15be0f
SHA1c0f61896efffe260ede62191d09a913190b34e7a
SHA25604b02bbf33d0fce6ea8ab06d8dd98f395c6d51be5719818ec07514c2b96c1dae
SHA51220494e9150411345ffe266b1b8b1222f274196edf181111ba166f43c0cca1c1cee40576ae30a365b20745cba3d2a13e2591eec34bb6dadacfe1dd1791856daef
-
Filesize
224KB
MD5193407c50bd164a1507d9cee999889a4
SHA1ce51c5a22242f9a5ed9d9d8071256824d21729ff
SHA2561880eee6a35ab1af095b7399be391efaf014b7199535927a94e3e686727f7ea2
SHA5125d7f0c5432f53a441ea65a849a503f52218915936a9f73e27521a6ee88e9c1dfb22b1873a5b60422794d86e64d982de9c65b297cbe57425916d66395cf5226d8