Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 12:11

General

  • Target

    353a6f797e3e2c4e296ee8e5a72e393657f8e84889edd579d6f239c5d4ada270N.exe

  • Size

    977KB

  • MD5

    fea83f260f2972644d1dd41309f41200

  • SHA1

    859123bbf12e66d283c9a991f1ee62e8f7061ac5

  • SHA256

    353a6f797e3e2c4e296ee8e5a72e393657f8e84889edd579d6f239c5d4ada270

  • SHA512

    96d6676794b3a19506749ac7723a028a4c5f199ee414f80811f7cf01b4e2376917d444a0e0dc31d95439d5f41a2b0ba47fd05abac147912ee295a026410fa4bc

  • SSDEEP

    24576:QqNfcE3qokV5EkITpoWZHUkAjVhMfo9NWtxIVSfb+PP4Iyv10cv:QSkWFEEXyZVhf94txePOecv

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7327372938:AAHFwuC3knQ9jY-1T98yh8owXZiixS_neU0/sendMessage?chat_id=6951521546

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3400
      • C:\Users\Admin\AppData\Local\Temp\353a6f797e3e2c4e296ee8e5a72e393657f8e84889edd579d6f239c5d4ada270N.exe
        "C:\Users\Admin\AppData\Local\Temp\353a6f797e3e2c4e296ee8e5a72e393657f8e84889edd579d6f239c5d4ada270N.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2676
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3620

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2676-0-0x00007FFA7BA23000-0x00007FFA7BA25000-memory.dmp

      Filesize

      8KB

    • memory/2676-1-0x000001CA99E30000-0x000001CA99F28000-memory.dmp

      Filesize

      992KB

    • memory/2676-2-0x000001CAB4530000-0x000001CAB4616000-memory.dmp

      Filesize

      920KB

    • memory/2676-50-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-48-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-46-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-44-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-42-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-36-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-34-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-30-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-24-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-18-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-14-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-12-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-10-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-6-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-66-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-64-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-219-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/2676-62-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-60-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-58-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-56-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-55-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-52-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-40-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-38-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-32-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-28-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-26-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-22-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-20-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-16-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-8-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-3-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-4-0x000001CAB4530000-0x000001CAB4611000-memory.dmp

      Filesize

      900KB

    • memory/2676-1078-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/2676-1079-0x000001CAB4450000-0x000001CAB44B2000-memory.dmp

      Filesize

      392KB

    • memory/2676-1080-0x000001CAB44B0000-0x000001CAB44FC000-memory.dmp

      Filesize

      304KB

    • memory/2676-1083-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/2676-1085-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/2676-1086-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/2676-1087-0x000001CAB4620000-0x000001CAB4674000-memory.dmp

      Filesize

      336KB

    • memory/2676-1090-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/3620-1091-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/3620-1092-0x0000000140000000-0x0000000140024000-memory.dmp

      Filesize

      144KB

    • memory/3620-1093-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/3620-1094-0x00007FFA7BA20000-0x00007FFA7C4E1000-memory.dmp

      Filesize

      10.8MB

    • memory/3620-1095-0x000001A63E960000-0x000001A63E9B0000-memory.dmp

      Filesize

      320KB

    • memory/3620-1096-0x000001A657640000-0x000001A657802000-memory.dmp

      Filesize

      1.8MB