Analysis
-
max time kernel
140s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 05:48
Static task
static1
Behavioral task
behavioral1
Sample
f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe
Resource
win10v2004-20241007-en
General
-
Target
f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe
-
Size
11KB
-
MD5
a0a010c6bc3aeca4c61b88d83b7bc4fc
-
SHA1
82bff34d56ae4d659f32197b485681b3bee58b55
-
SHA256
f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b
-
SHA512
33c08b1a138fcf4d24f6a124d39d6ce937cd2f4a49c2a5076c4da64f14bf61e104e430bc92e672508c49d95ce2f4663bab4d77e36ff83a518a0a2ef0925ba0c1
-
SSDEEP
192:zow9iG8qkoI0xF5H2nQfmG4NlUeKrfBzEL6:HkJKJGQP4NSeoBzEL
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7662274889:AAGmLpUAq41adIZH12LVtlSBknhfnx9iQ2g/sendMessage?chat_id=2052461776
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/4696-1094-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3796 created 3436 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 56 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3796 set thread context of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 4696 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe Token: SeDebugPrivilege 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe Token: SeDebugPrivilege 4696 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 3796 wrote to memory of 4696 3796 f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe 96 PID 4696 wrote to memory of 3980 4696 RegAsm.exe 97 PID 4696 wrote to memory of 3980 4696 RegAsm.exe 97 PID 4696 wrote to memory of 3980 4696 RegAsm.exe 97 PID 3980 wrote to memory of 2604 3980 cmd.exe 99 PID 3980 wrote to memory of 2604 3980 cmd.exe 99 PID 3980 wrote to memory of 2604 3980 cmd.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe"C:\Users\Admin\AppData\Local\Temp\f56f43c8d7da32aa5405d30ed032c70880ce08b7b7fbb09b9d3f3e78930cd52b.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:2604
-
-
-