Analysis

  • max time kernel
    106s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-10-2024 01:54

General

  • Target

    824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e.exe

  • Size

    1.0MB

  • MD5

    7fe1b33acbb4390827636fbbe0bbeec7

  • SHA1

    6f7df0c28218e0a28f67c0b3a8e5d7f87206a8cb

  • SHA256

    824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e

  • SHA512

    e0504c344a51829b964b8713d939bd2b2279335b085252ac8fefd39ad613fa51c51594df7e8d99ce91c38ce922d23a479818cdd1f353841ab3edf28277757826

  • SSDEEP

    12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLvOByP0HUJWO+WF/bsB26tVMk9+U29V:ffmMv6Ckr7Mny5QLYBWyo67h9AdpfPP

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7952998151:AAFh98iY7kaOlHAR0qftD3ZcqGbQm0TXbBY/sendMessage?chat_id=5692813672

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 5 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e.exe
    "C:\Users\Admin\AppData\Local\Temp\824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Users\Admin\AppData\Local\directory\name.exe
      "C:\Users\Admin\AppData\Local\Temp\824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4264
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 736
        3⤵
        • Program crash
        PID:5096
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1312 -ip 1312
    1⤵
      PID:844

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\directory\name.exe

      Filesize

      1.0MB

      MD5

      7fe1b33acbb4390827636fbbe0bbeec7

      SHA1

      6f7df0c28218e0a28f67c0b3a8e5d7f87206a8cb

      SHA256

      824e4e4246a92fc2bfe21b29045a8c60e1f73f14ca7d846c140ac2ef5d817e5e

      SHA512

      e0504c344a51829b964b8713d939bd2b2279335b085252ac8fefd39ad613fa51c51594df7e8d99ce91c38ce922d23a479818cdd1f353841ab3edf28277757826

    • memory/1312-10-0x0000000003EC0000-0x00000000042C0000-memory.dmp

      Filesize

      4.0MB

    • memory/4264-16-0x00000000742FE000-0x00000000742FF000-memory.dmp

      Filesize

      4KB

    • memory/4264-18-0x00000000061B0000-0x0000000006754000-memory.dmp

      Filesize

      5.6MB

    • memory/4264-13-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/4264-15-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/4264-14-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/4264-24-0x00000000742FE000-0x00000000742FF000-memory.dmp

      Filesize

      4KB

    • memory/4264-17-0x0000000005890000-0x00000000058B6000-memory.dmp

      Filesize

      152KB

    • memory/4264-12-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/4264-19-0x0000000005C00000-0x0000000005C9C000-memory.dmp

      Filesize

      624KB

    • memory/4264-20-0x0000000006C90000-0x0000000006CE0000-memory.dmp

      Filesize

      320KB

    • memory/4264-21-0x0000000006EB0000-0x0000000007072000-memory.dmp

      Filesize

      1.8MB

    • memory/4264-22-0x0000000006D80000-0x0000000006E12000-memory.dmp

      Filesize

      584KB

    • memory/4264-23-0x0000000006D40000-0x0000000006D4A000-memory.dmp

      Filesize

      40KB

    • memory/5024-2-0x00000000040E0000-0x00000000042E0000-memory.dmp

      Filesize

      2.0MB