Analysis
-
max time kernel
135s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 01:56
General
-
Target
8248df24bfd99d9869ec94c4d3321b61171a3c5137921bdd254e40118c50d0b7.exe
-
Size
949KB
-
MD5
d5b3d11c19dcb6e3125415c0dedfe2b6
-
SHA1
f4c8309c80c85b8d1316fb88a90102d81c3474fd
-
SHA256
8248df24bfd99d9869ec94c4d3321b61171a3c5137921bdd254e40118c50d0b7
-
SHA512
d1e9e87e82a29c4d24bc2ea25740032b93af7ee048309c9ed2e249578dca8b7558fe561fb25ec22eeceea62fb2b05607fad6c5eff724657612f12dc109f3f107
-
SSDEEP
12288:CDN+hU6YasBZbnT9pf0K+Dg0I6d3oxs0P3hCYbVVUhyeb5zXre:CfBZbnJFx+Dp2FUjVz6
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
granjaarmengol.com - Port:
587 - Username:
[email protected] - Password:
28112811Ab - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8248df24bfd99d9869ec94c4d3321b61171a3c5137921bdd254e40118c50d0b7.exe"C:\Users\Admin\AppData\Local\Temp\8248df24bfd99d9869ec94c4d3321b61171a3c5137921bdd254e40118c50d0b7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
968KB
-
Filesize
632KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
404KB
-
Filesize
760KB
-
Filesize
576KB
-
Filesize
632KB
-
Filesize
688KB
-
Filesize
2.8MB
-
Filesize
620KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
1.0MB
-
Filesize
192KB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
100KB
-
Filesize
176KB
-
Filesize
7.2MB
-
Filesize
704KB
-
Filesize
32KB
-
Filesize
676KB
-
Filesize
2.5MB
-
Filesize
820KB
-
Filesize
1.1MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
124KB
-
Filesize
7.6MB
-
Filesize
692KB
-
Filesize
48KB
-
Filesize
156KB
-
Filesize
208KB
-
Filesize
96KB
-
Filesize
632KB
-
Filesize
524KB
-
Filesize
3.3MB
-
Filesize
1024KB
-
Filesize
628KB
-
Filesize
172KB
-
Filesize
136KB
-
Filesize
756KB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
340KB
-
Filesize
680KB
-
Filesize
1.2MB
-
Filesize
104KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
144KB