Extracted

• • Target

    SYSN ORDER.xls

  • Size

    641KB

  • MD5

    673bd0aa988ca4a1ef05edb3d5b68d60

  • SHA1

    4b7d31c4d6a4cd94e95fdd7c35bca86f6e13ec38

  • SHA256

    9db5ab81cbe373ea471f128ad2fdc98c9eb98c1ff3991046f7ca54823d9a6107

  • SHA512

    0af25507fd68eb9e8a9df4b1a93f6fad31429d0c0d37d326482ace999f5859f18ef3521c7e71146f41afcf45e7bbaf0d1d77543cc8abfb9c38ac2057cca9929c

  • SSDEEP

    12288:GOyBFRSc/ol3o3+io8tM7qgSwaY0c6bde1bmnyqkZH1:GTBShxE+iokM7qgadcgdwmlkZ

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2