Analysis
- max time kernel
140s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
06/11/2024, 09:37
General
- Target QUOTATION_NOVQTRA071244·PDF.scr
- Size 412KB
- Sample241106-llmkjaycjq
- SHA256 e1eaf901b41bfdc10adce756822f36f7ad94df652d27a86e935d258f9b43a7bd
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
gator3220.hostgator.com
-
Port
587
-
Username
-
Password
G!!HFpD@N*]*nF
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Snakekeylogger family
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244·PDF.scr"C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244·PDF.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2360-1094-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/2360-1095-0x0000000140000000-0x0000000140024000-memory.dmp
memory/2360-1096-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/2360-1097-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/2360-1098-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/2360-1100-0x000002B7C9470000-0x000002B7C9632000-memory.dmp
memory/2360-1099-0x000002B7C8F60000-0x000002B7C8FB0000-memory.dmp
memory/3104-27-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-17-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-21-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-13-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-4-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-29-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-67-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-65-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-61-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-59-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-57-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-55-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-54-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-49-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-47-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-45-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-43-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-39-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-37-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-35-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-33-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-2-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-25-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-23-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-19-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-3-0x000001AAAC220000-0x000001AAAC30E000-memory.dmp
memory/3104-15-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-11-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-9-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-7-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-6-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-63-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-51-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-41-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-31-0x000001AAAC220000-0x000001AAAC308000-memory.dmp
memory/3104-1078-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1080-0x000001AAAC570000-0x000001AAAC5BC000-memory.dmp
memory/3104-1079-0x000001AAAC510000-0x000001AAAC570000-memory.dmp
memory/3104-1084-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1085-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1086-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1087-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1088-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1-0x000001AA91AD0000-0x000001AA91B3C000-memory.dmp
memory/3104-0-0x00007FF8E2C43000-0x00007FF8E2C45000-memory.dmp
memory/3104-1089-0x00007FF8E2C43000-0x00007FF8E2C45000-memory.dmp
memory/3104-1090-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp
memory/3104-1091-0x000001AAAC800000-0x000001AAAC854000-memory.dmp
memory/3104-1093-0x00007FF8E2C40000-0x00007FF8E3701000-memory.dmp