Analysis
-
max time kernel
95s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe
Resource
win10v2004-20241007-en
General
-
Target
e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe
-
Size
2.0MB
-
MD5
f107093ca8c59b80610b4169011e191b
-
SHA1
92c71dd5a306556b5e114bc044dce66672bf5dbd
-
SHA256
e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4
-
SHA512
4474bdba442d64fb680b36cbfd8c75c66287fb2643d0f869ef087799d5388b16d7422bf4f9049258bb325678966763c038dae69268172dcde03fcf21701ef651
-
SSDEEP
12288:m6G6SmMovrikZH/IOxg5p6Z0PuHufm4to544VmxSfXwPzWwPW:V/MoD5VOBnLW
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5959992477:AAHE-7vhpGmcidn94EXH2Dz0foqgJdGDb1E/sendMessage?chat_id=6070433873
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/3520-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4812 set thread context of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 3520 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe Token: SeDebugPrivilege 3520 InstallUtil.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 4428 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 91 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 4812 wrote to memory of 3520 4812 e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe 92 PID 3520 wrote to memory of 920 3520 InstallUtil.exe 94 PID 3520 wrote to memory of 920 3520 InstallUtil.exe 94 PID 3520 wrote to memory of 920 3520 InstallUtil.exe 94 PID 920 wrote to memory of 4988 920 cmd.exe 96 PID 920 wrote to memory of 4988 920 cmd.exe 96 PID 920 wrote to memory of 4988 920 cmd.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe"C:\Users\Admin\AppData\Local\Temp\e3943672b62d0091f373faef1565c6bc328b9fa97ce1a3f6e76b06596ad38fc4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:4428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:4988
-
-
-