Analysis
- max time kernel
116s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
13/09/2024, 12:03
General
- Target Tpnit.exe
- Size 959KB
- Sample240913-n7116a1ara
- SHA256 f5b1deb060982e05d98c940ebf0b8d50cef95922fab5fed5ed8c2a9d7acdda80
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot7327372938:AAHFwuC3knQ9jY-1T98yh8owXZiixS_neU0/sendMessage?chat_id=6951521546
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Tpnit.exe"C:\Users\Admin\AppData\Local\Temp\Tpnit.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3892-0-0x00007FFACF013000-0x00007FFACF015000-memory.dmp
memory/3892-1-0x00000298B6050000-0x00000298B6144000-memory.dmp
memory/3892-2-0x00000298D0560000-0x00000298D0646000-memory.dmp
memory/3892-3-0x00000298D0650000-0x00000298D0736000-memory.dmp
memory/3892-62-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-59-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-61-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/3892-57-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-55-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-15-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-13-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-68-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-66-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-64-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-53-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-51-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-49-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-47-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-45-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-43-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-42-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-39-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-37-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-35-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-33-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-31-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-29-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-27-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-25-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-23-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-21-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-19-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-17-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-11-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-9-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-7-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-5-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-4-0x00000298D0650000-0x00000298D0731000-memory.dmp
memory/3892-1079-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/3892-1080-0x00000298D0840000-0x00000298D08A2000-memory.dmp
memory/3892-1081-0x00000298D08A0000-0x00000298D08EC000-memory.dmp
memory/3892-1085-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/3892-1086-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/3892-1087-0x00007FFACF013000-0x00007FFACF015000-memory.dmp
memory/3892-1089-0x00000298D1BA0000-0x00000298D1BF4000-memory.dmp
memory/3892-1092-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/4960-1093-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/4960-1094-0x0000000140000000-0x0000000140024000-memory.dmp
memory/4960-1095-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp
memory/4960-1096-0x0000018A8D6B0000-0x0000018A8D700000-memory.dmp
memory/4960-1097-0x0000018AA64F0000-0x0000018AA66B2000-memory.dmp
memory/4960-1098-0x00007FFACF010000-0x00007FFACFAD1000-memory.dmp