Analysis
- max time kernel
105s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/10/2024, 17:45
General
- Target Justificante de pago.exe
- Size 1.1MB
- Sample241007-wbqvbavbre
- SHA256 e080f9706527c90237f613bdb674112e2b5a6e2e14138498dc31397661fb7efb
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot6758088233:AAFj4Y2Zn6GDp8qtYIlHf1VVN4k4QQ5uaio/sendMessage?chat_id=5117030493
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 5 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Justificante de pago.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
name.exe
memory/100-2-0x00000000043B0000-0x00000000047B0000-memory.dmp
memory/1504-20-0x0000000003E90000-0x0000000004290000-memory.dmp
memory/1504-10-0x0000000003E90000-0x0000000004290000-memory.dmp
memory/4228-12-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4228-14-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4228-15-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4228-16-0x0000000074B9E000-0x0000000074B9F000-memory.dmp
memory/4228-17-0x0000000005AE0000-0x0000000005B06000-memory.dmp
memory/4228-18-0x00000000063B0000-0x0000000006954000-memory.dmp
memory/4228-19-0x0000000005EA0000-0x0000000005F3C000-memory.dmp
memory/4228-13-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4228-21-0x0000000006EF0000-0x0000000006F40000-memory.dmp
memory/4228-22-0x0000000007110000-0x00000000072D2000-memory.dmp
memory/4228-23-0x0000000006FE0000-0x0000000007072000-memory.dmp
memory/4228-24-0x0000000006F90000-0x0000000006F9A000-memory.dmp
memory/4228-25-0x0000000074B9E000-0x0000000074B9F000-memory.dmp