Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2024, 01:32

General

  • Target

    b03066c712ac4c570433b996907d239a417eb0ae517307faa1122dbb560da08a.exe

  • Size

    549KB

  • MD5

    b5a3a038692a38e4efcd86e079557589

  • SHA1

    18c533cbf19bfbef0959bf2c1a8d2251ab4e64a8

  • SHA256

    b03066c712ac4c570433b996907d239a417eb0ae517307faa1122dbb560da08a

  • SHA512

    5327b668e44bea2bd5331f50b1dbc99f3c3110fa26fb48791795ef8f3cb461d650dfbeb0d5ff9049fc1579bc232ad9adffb1ee9b761e39e85b68afcba0acfcca

  • SSDEEP

    3072:JNWTb+AdIg8j+kCpeD0D7L5HA1onW8D1mw5FPw:qTb+Ado4LTUAW8pmcFP

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    gator3220.hostgator.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Zg^!Zy[?IKrs99@soltan

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\b03066c712ac4c570433b996907d239a417eb0ae517307faa1122dbb560da08a.exe
        "C:\Users\Admin\AppData\Local\Temp\b03066c712ac4c570433b996907d239a417eb0ae517307faa1122dbb560da08a.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:396
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4556

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/396-1-0x0000028FEDC50000-0x0000028FEDCDE000-memory.dmp

      Filesize

      568KB

    • memory/396-0-0x00007FFE70903000-0x00007FFE70905000-memory.dmp

      Filesize

      8KB

    • memory/396-2-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/396-3-0x0000028FF04F0000-0x0000028FF05F0000-memory.dmp

      Filesize

      1024KB

    • memory/396-17-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-19-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-27-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-25-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-23-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-21-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-15-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-13-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-11-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-9-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-7-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-5-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-29-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-4-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-39-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-67-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-65-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-63-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-61-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-57-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-51-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-49-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-47-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-45-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-37-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-35-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-59-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-55-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-53-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-43-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-41-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-33-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-31-0x0000028FF04F0000-0x0000028FF05EA000-memory.dmp

      Filesize

      1000KB

    • memory/396-1078-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/396-1079-0x0000028FF0660000-0x0000028FF06DC000-memory.dmp

      Filesize

      496KB

    • memory/396-1080-0x0000028FF06E0000-0x0000028FF072C000-memory.dmp

      Filesize

      304KB

    • memory/396-1084-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/396-1085-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/396-1086-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/396-1087-0x00007FFE70903000-0x00007FFE70905000-memory.dmp

      Filesize

      8KB

    • memory/396-1088-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/396-1090-0x0000028FF19E0000-0x0000028FF1A34000-memory.dmp

      Filesize

      336KB

    • memory/396-1092-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4556-1093-0x0000020605970000-0x0000020605998000-memory.dmp

      Filesize

      160KB

    • memory/4556-1094-0x00007FFE70903000-0x00007FFE70905000-memory.dmp

      Filesize

      8KB

    • memory/4556-1095-0x00000206074D0000-0x00000206074F4000-memory.dmp

      Filesize

      144KB

    • memory/4556-1097-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4556-1096-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4556-1098-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB

    • memory/4556-1099-0x0000020621080000-0x00000206210D0000-memory.dmp

      Filesize

      320KB

    • memory/4556-1100-0x00000206212A0000-0x0000020621462000-memory.dmp

      Filesize

      1.8MB

    • memory/4556-1101-0x00007FFE70903000-0x00007FFE70905000-memory.dmp

      Filesize

      8KB

    • memory/4556-1102-0x00007FFE70900000-0x00007FFE713C1000-memory.dmp

      Filesize

      10.8MB