Extracted

• • Target

    Pedido de GmbH.xls

  • Size

    706KB

  • MD5

    7cf3baf28b4c40a5e747ff8b89f001d7

  • SHA1

    17ce4f2d4d833ff744335b635b7a37be7ef32f6f

  • SHA256

    e72bf4cc80fc4cd1b1924851e85b45b06c20de1d7490947a01197bca64036e4c

  • SHA512

    fdde12d17b5d3881ea98df4da3dcd82108c4b988ed134b920d49bad393fece0242f5e9181f86ee8b24beb526b7a46ca7a837808e30f8705456fd2a7a6f317789

  • SSDEEP

    12288:m+UOAsHFnd7HeT/o8gg8Rsfe8fB7RY/KKCjCdAT2bbBme+I0u+ssDsh6PG:mepsAbg8R8BNGKtUAT2/YjssDs4P

  Score

  10^/10

  snakekeyloggerdefense_evasiondiscoveryexecutionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2