Analysis

  • max time kernel
    95s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-11-2024 04:02

General

  • Target

    7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe

  • Size

    646KB

  • MD5

    5556070b7b98ac900b15008dc307f93b

  • SHA1

    58a09bf573b4b91ee7acb9915f85c45dbd8a9811

  • SHA256

    7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc

  • SHA512

    8bdc68e2408c173d80abfcd234f063a3b54724d53676c10483b369b96948bcc5eace7c1c2ad6c487505b42392ab050b7adb316f7776ef4c02118e390dfefb05e

  • SSDEEP

    12288:gUxHU3TBLTyOYRSHrM65aj0iqPBxgWaRNo77Om6d4zp:gUxGLTyTRI34v7yp

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe
    "C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2684
    • C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe
      "C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe"
      2⤵
        PID:3268
      • C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe
        "C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe"
        2⤵
          PID:1684
        • C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe
          "C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe"
          2⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4364
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4932

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7a1b1accd1cb42cb51060c603ca409ca6345a52035cc2a4cb356e42abd4df5bc.exe.log

        Filesize

        1KB

        MD5

        36049bae97bba745c793444373453cb0

        SHA1

        eb6e9a822944e8e207abba1a5e53f0183a1684f1

        SHA256

        839fa1f9725719938ffa24533587b168bae2768f23ac09dccb3ad4ab8ae6abcd

        SHA512

        a6584b7b435afeffb6becfbed82517087030eb23534fa50deecd02330bf36d633ba22e979e36b9c27e35885f9cc1cc9481dadc53cc265be61391e11a7c2c7cdb

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2jjnihvg.jww.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/1140-10-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/1140-36-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/1140-34-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/1140-12-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2684-18-0x0000000005900000-0x0000000005922000-memory.dmp

        Filesize

        136KB

      • memory/2684-33-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2684-61-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2684-58-0x0000000007F10000-0x0000000007F18000-memory.dmp

        Filesize

        32KB

      • memory/2684-57-0x0000000007F30000-0x0000000007F4A000-memory.dmp

        Filesize

        104KB

      • memory/2684-56-0x0000000007E30000-0x0000000007E44000-memory.dmp

        Filesize

        80KB

      • memory/2684-55-0x0000000007E20000-0x0000000007E2E000-memory.dmp

        Filesize

        56KB

      • memory/2684-13-0x0000000005330000-0x0000000005366000-memory.dmp

        Filesize

        216KB

      • memory/2684-16-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2684-15-0x0000000005A20000-0x0000000006048000-memory.dmp

        Filesize

        6.2MB

      • memory/2684-54-0x0000000007DF0000-0x0000000007E01000-memory.dmp

        Filesize

        68KB

      • memory/2684-20-0x0000000006280000-0x00000000062E6000-memory.dmp

        Filesize

        408KB

      • memory/2684-19-0x00000000059A0000-0x0000000005A06000-memory.dmp

        Filesize

        408KB

      • memory/2684-17-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/2684-53-0x0000000007E70000-0x0000000007F06000-memory.dmp

        Filesize

        600KB

      • memory/2684-30-0x00000000063F0000-0x0000000006744000-memory.dmp

        Filesize

        3.3MB

      • memory/2684-31-0x00000000068C0000-0x00000000068DE000-memory.dmp

        Filesize

        120KB

      • memory/2684-52-0x0000000007C60000-0x0000000007C6A000-memory.dmp

        Filesize

        40KB

      • memory/2684-32-0x0000000006900000-0x000000000694C000-memory.dmp

        Filesize

        304KB

      • memory/2684-51-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

        Filesize

        104KB

      • memory/2684-50-0x0000000008230000-0x00000000088AA000-memory.dmp

        Filesize

        6.5MB

      • memory/2684-49-0x00000000078C0000-0x0000000007963000-memory.dmp

        Filesize

        652KB

      • memory/2684-37-0x0000000006E90000-0x0000000006EC2000-memory.dmp

        Filesize

        200KB

      • memory/2684-38-0x0000000071620000-0x000000007166C000-memory.dmp

        Filesize

        304KB

      • memory/2684-48-0x0000000006ED0000-0x0000000006EEE000-memory.dmp

        Filesize

        120KB

      • memory/3452-1-0x00000000002C0000-0x0000000000366000-memory.dmp

        Filesize

        664KB

      • memory/3452-2-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/3452-3-0x0000000005410000-0x00000000059B4000-memory.dmp

        Filesize

        5.6MB

      • memory/3452-7-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/3452-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

        Filesize

        4KB

      • memory/3452-4-0x0000000004F20000-0x0000000004FB2000-memory.dmp

        Filesize

        584KB

      • memory/3452-14-0x0000000074B30000-0x00000000752E0000-memory.dmp

        Filesize

        7.7MB

      • memory/3452-5-0x00000000066D0000-0x00000000066EE000-memory.dmp

        Filesize

        120KB

      • memory/3452-6-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

        Filesize

        4KB

      • memory/3452-9-0x000000000AC70000-0x000000000AD0C000-memory.dmp

        Filesize

        624KB

      • memory/3452-8-0x00000000025C0000-0x0000000002628000-memory.dmp

        Filesize

        416KB