Extracted

• • Target

    Athnaton_ANP00224_Specification.xls

  • Size

    939KB

  • MD5

    15d90d6aa9eb2c890494884bdaff2e91

  • SHA1

    d55134055fb68cab73e32d6ed70d936399484a3d

  • SHA256

    d472c895106cfebcb6eea8701416aed96b9770c256432ee7ee7a9b8a60a6d254

  • SHA512

    a4f10b41f37be48b3ddf83e6c0d133cd8ae8655c4a8fac3235be0dc961c5bf2e3e80d6b924b446ba44a07b7bbdbf99d87b308637332bbb050b4c51c25dab5c8e

  • SSDEEP

    12288:xmzHJEjwWYSqD3DERnLRmF8Dl3PTKuG44G24rBedMPQr6eyCQSEB9:gcwHSqbARM8B3ugedV7Q

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2