Extracted

• • Target

    TTXAPPLICATION.xls

  • Size

    1.0MB

  • MD5

    a88d8222f0c50bf06a91b3a9567c3306

  • SHA1

    eb6afe8b34c4fd7c15104630e6a666322ba7420f

  • SHA256

    e7163358d7945ac9fa343eb49725d8ce1021993347178b1f5725e4689fd35059

  • SHA512

    0db10f1be93c95dda95425cff166e5ef87e3db6daa8f1ca882dd97a5a8f9bde893a3586bdd0a2ceeb744bd8d5c70b2c2a5c3388a1fe193a1d9501c76c8569259

  • SSDEEP

    12288:xmzHJEHAfwu4hqD3DERnLRmF8DfPrf173d2FuLg70Je/mAI98dvj54002UZlAZ:gLw/hqbARM83V3uaGjS000

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2