Extracted

• • Target

    CANADAXORDER.xls

  • Size

    866KB

  • MD5

    b74b9f77a4f538ff131c1be7ed01414f

  • SHA1

    25dac77c5cf517d87da4e2b936a294b88c73185d

  • SHA256

    c041864b59bbcc3ffb518337b77a636aa23967f552ec712ffebc25df56f399f1

  • SHA512

    19b80ce89cef0288e95081dab9da47df5afc20a958159cd9ac9f96177fb0e249ee713524f703109b3effaf1f48a28251187fd6b0c2eb59d4be870d0eb53932c7

  • SSDEEP

    24576:2VgVPjrLE7wRtMk8gwYRJBeMgBDDb/7zpkH/6:2yjXE7wRKzERJTgBXbm

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2