Analysis
-
max time kernel
264s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-ja -
resource tags
-
submitted
01-10-2024 02:04
General
-
Target
Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe
-
Size
602KB
-
MD5
a168b11261c075963b1dfd139cbbfac6
-
SHA1
3248fcfe659305dba908ee7271da1a3c72f103c1
-
SHA256
32b59977aff73828e93c0844e7805de9c854049bb3b046399f1ce42e58679b85
-
SHA512
234e9aae8e8b8f959c1a1c21170619e09270eff0e8be8059a085c03adc354fcc7c1dadffd5c2dfa8644850bb8657fbfb3bee3b77cd8823ce00470517f41ec9fa
-
SSDEEP
12288:PWt7LZ0ohLCU8Ow2ZHdobZZrVFtuH+c3T:PWt7V0ohLCUVw2grke
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 44 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 18363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1684 -ip 16841⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 20523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4880 -ip 48801⤵
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 19963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5904 -ip 59041⤵
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"C:\Users\Admin\AppData\Local\Temp\Rfq H2110-11 Order_ROYPOWTECH %100% S51105P-E01 （最新）.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5856 -s 19363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5856 -ip 58561⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD5ba246bd2d86f16b8e701e797989d424b
SHA1048769be2e48bd66ddedbfcf9d40addb6168fc16
SHA25637c38ce312bc65167a7a6208217dedc66559bd6dd149472fd7001a8e9db310ad
SHA512473fedc38e188d36b1f2f3db119a5c6c1e8676a24392a64b60198ab38c6725a909b8564892608760cc2dfc6a1b4f72cf4370740f97dcb0722d3fd4e0faa57bec
-
Filesize
18KB
MD5d6d16e8eb1130104febfdde68f7a3dce
SHA1361b3cb65300893dff86d7ed2152f3c188d12ad8
SHA25625e1b350760c90af930127f73609c4e5b89048a156f898d54e59177e3a0751f2
SHA512c0d944cff0a681b54dda9a3e577172b4b453445880f01ccab9132aa45836e61202c5ab36669460730a0ce1b3279178773a5be51e8f51cba3f423550058bda849
-
Filesize
18KB
MD5712ae22b2a15b828f260cd819cf41d7b
SHA18f862b6767f0a2be52c1b379c5aee80ae3f41150
SHA256a6b5bacb1a862d0245f7b93d72ae4ab7178f614fc72f1780973ec1ec5bfb7eb5
SHA51217bdadcae4ffd54f0f8c09f59106dc08175eea04930ddb4e1b70e20541e394fe5a9f49c32b098230f6196ce81c557eebfb4083741cab4038b21e29bcbc532d2b
-
Filesize
18KB
MD5145904a074f7235d7cfbd6acbf8db85d
SHA1ebe5e5690c33547f14f2d7b893e9d63fb1a5b2ea
SHA2561071e754156af9fc8167192898379bf5cf8af98e705763cd8a3422b066ab568c
SHA512fa0de4238663dbf0962388a09983c2bb4b8f8bf4c6b1b52894f1da262c53285a21b286e5f84940a3792f07856589edb57676af2823ee463dd74cfaa8279a32d3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
152KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
1.1MB
-
Filesize
56KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
416KB
-
Filesize
624KB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
200KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
408KB
-
Filesize
80KB
-
Filesize
68KB
-
Filesize
652KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
3.3MB