Analysis
- max time kernel
104s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
14/07/2024, 08:09
General
- Target DHL Waybill & Shipping Document.exe
- Size 2.8MB
- Sample240714-j15csaverc
- SHA256 fa4dd3214fe17f69079274a2dd01ed191a1b7c70c96bc36d274a5f6758deaffb
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot6040706883:AAGj7B9ONNWM5dxNf28Wuf8zMNReKmR75X0/sendMessage?chat_id=6081058038
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Waybill & Shipping Document.exe"C:\Users\Admin\AppData\Local\Temp\DHL Waybill & Shipping Document.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2384-12-0x00000000065C0000-0x0000000006782000-memory.dmp
memory/2384-9-0x0000000074C30000-0x00000000753E0000-memory.dmp
memory/2384-16-0x0000000074C30000-0x00000000753E0000-memory.dmp
memory/2384-15-0x0000000074C3E000-0x0000000074C3F000-memory.dmp
memory/2384-14-0x0000000006420000-0x000000000642A000-memory.dmp
memory/2384-5-0x0000000000400000-0x0000000000426000-memory.dmp
memory/2384-6-0x0000000074C3E000-0x0000000074C3F000-memory.dmp
memory/2384-7-0x00000000055E0000-0x0000000005B84000-memory.dmp
memory/2384-13-0x0000000006490000-0x0000000006522000-memory.dmp
memory/2384-11-0x00000000063A0000-0x00000000063F0000-memory.dmp
memory/2384-8-0x00000000050D0000-0x000000000516C000-memory.dmp
memory/2412-10-0x00007FFE4E760000-0x00007FFE4F221000-memory.dmp
memory/2412-0-0x00007FFE4E763000-0x00007FFE4E765000-memory.dmp
memory/2412-1-0x0000019BF6D90000-0x0000019BF6D98000-memory.dmp
memory/2412-4-0x00007FFE4E760000-0x00007FFE4F221000-memory.dmp
memory/2412-3-0x0000019BF9140000-0x0000019BF91BA000-memory.dmp
memory/2412-2-0x0000019BF9290000-0x0000019BF9298000-memory.dmp