Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2024, 15:01

General

  • Target

    Qaovmgmn.exe

  • Size

    1.1MB

  • MD5

    2fcc31707bfa6f3b9a82ef482e81f08f

  • SHA1

    f820b95c7e9d10d951c3d48c2b491b64ed274534

  • SHA256

    6d56700e490fbb082d3ff3fbde1bdb8404c0dd033e05a0e6b63d649bb06b03c0

  • SHA512

    1cfa47e1a602467386b11f86a67252046cad119f378c2f09362efe60c7a9ce8e6ba26dd452d87e9dd6f7c1de00682a986495f4ec3708c15440441592a65fcbb9

  • SSDEEP

    24576:Pt4rexG2D35fmUw5UpCZI3M3xr7KT8LwcCouwvxA688j:V4rexG2D3nw6pCZyMhvKrrTQxAl8j

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7733918918:AAEtGoUvhJXT-4wtbogjQ__0KDlSf2pw6MQ/sendMessage?chat_id=7969902771

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops startup file 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\Qaovmgmn.exe
        "C:\Users\Admin\AppData\Local\Temp\Qaovmgmn.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops startup file
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1968
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:5428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1968-1-0x000001AC8A650000-0x000001AC8A774000-memory.dmp

      Filesize

      1.1MB

    • memory/1968-0-0x00007FF8AC373000-0x00007FF8AC375000-memory.dmp

      Filesize

      8KB

    • memory/1968-2-0x000001ACA4DE0000-0x000001ACA4ECE000-memory.dmp

      Filesize

      952KB

    • memory/1968-56-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-36-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-10-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-8-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-6-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-62-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-66-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-64-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-60-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-58-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-54-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-52-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-50-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-48-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-46-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-44-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-42-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-40-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-38-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-34-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-32-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-31-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-28-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-26-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-24-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-23-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-21-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-18-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-16-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-14-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-12-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-4-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-3-0x000001ACA4DE0000-0x000001ACA4EC9000-memory.dmp

      Filesize

      932KB

    • memory/1968-1077-0x000001AC8ABA0000-0x000001AC8AC02000-memory.dmp

      Filesize

      392KB

    • memory/1968-1079-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1080-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1078-0x000001AC8C640000-0x000001AC8C68C000-memory.dmp

      Filesize

      304KB

    • memory/1968-1083-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1085-0x000001ACA4ED0000-0x000001ACA4F24000-memory.dmp

      Filesize

      336KB

    • memory/1968-1086-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1087-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1090-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1091-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/1968-1093-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/5428-1095-0x0000000140000000-0x0000000140024000-memory.dmp

      Filesize

      144KB

    • memory/5428-1094-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/5428-1096-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB

    • memory/5428-1097-0x0000027BE5580000-0x0000027BE55D0000-memory.dmp

      Filesize

      320KB

    • memory/5428-1098-0x0000027BE5AF0000-0x0000027BE5CB2000-memory.dmp

      Filesize

      1.8MB

    • memory/5428-1099-0x00007FF8AC370000-0x00007FF8ACE31000-memory.dmp

      Filesize

      10.8MB