Analysis

  • max time kernel
    95s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 04:17

General

  • Target

    QUOTATION_NOVQTRA071244PDF.scr

  • Size

    1.4MB

  • MD5

    9c6de69b3f4bd16dc76a37fd8a50aea4

  • SHA1

    a5c6f87a637a6e5ffd073dc90a3cbfa0591160c1

  • SHA256

    137ad88b1c43f6aa6f01b9b8a7b15027387d501dbe7af463a7b639f5abf3f116

  • SHA512

    255dbc20c850d91eaccbe338b99ef1e144af703e6bc88c70f8d8d0f6dd2089cbbc6ddb2f8b4dccd6770c75bc21176ae41566eb995d58645ae0a86d42ef1d3841

  • SSDEEP

    12288:Yx093lfiCZNsgg/iUZ0vXTWyzopB2QrJ30Bme47vAn+TbzeB:YIiFzj+vXhzop5rJ3gmYSe

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    gator3220.hostgator.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    G!!HFpD@N*]*nF

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244PDF.scr
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244PDF.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2496-0-0x000001F596C10000-0x000001F596D7E000-memory.dmp

    Filesize

    1.4MB

  • memory/2496-1-0x00007FFB290C3000-0x00007FFB290C5000-memory.dmp

    Filesize

    8KB

  • memory/2496-2-0x000001F598960000-0x000001F598970000-memory.dmp

    Filesize

    64KB

  • memory/2496-3-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-4-0x000001F5B1520000-0x000001F5B1628000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-22-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-24-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-68-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-66-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-64-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-63-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-60-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-56-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-54-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-52-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-48-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-46-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-44-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-42-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-40-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-38-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-36-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-34-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-32-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-30-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-28-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-26-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-20-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-18-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-16-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-14-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-13-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-9-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-6-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-58-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-50-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-10-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-5-0x000001F5B1520000-0x000001F5B1622000-memory.dmp

    Filesize

    1.0MB

  • memory/2496-1079-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1080-0x000001F5B1250000-0x000001F5B12CA000-memory.dmp

    Filesize

    488KB

  • memory/2496-1081-0x000001F5989A0000-0x000001F5989EC000-memory.dmp

    Filesize

    304KB

  • memory/2496-1085-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1086-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1087-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1088-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1089-0x00007FFB290C3000-0x00007FFB290C5000-memory.dmp

    Filesize

    8KB

  • memory/2496-1090-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1091-0x000001F5B2920000-0x000001F5B2974000-memory.dmp

    Filesize

    336KB

  • memory/2496-1093-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/2496-1094-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/3056-1095-0x000001C360920000-0x000001C360948000-memory.dmp

    Filesize

    160KB

  • memory/3056-1096-0x00007FFB290C3000-0x00007FFB290C5000-memory.dmp

    Filesize

    8KB

  • memory/3056-1098-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/3056-1097-0x000001C37AC60000-0x000001C37AC84000-memory.dmp

    Filesize

    144KB

  • memory/3056-1099-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/3056-1100-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/3056-1101-0x00007FFB290C3000-0x00007FFB290C5000-memory.dmp

    Filesize

    8KB

  • memory/3056-1102-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB

  • memory/3056-1103-0x000001C37B9E0000-0x000001C37BA30000-memory.dmp

    Filesize

    320KB

  • memory/3056-1104-0x000001C37BC00000-0x000001C37BDC2000-memory.dmp

    Filesize

    1.8MB

  • memory/3056-1105-0x00007FFB290C0000-0x00007FFB29B81000-memory.dmp

    Filesize

    10.8MB