Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/11/2024, 13:01

General

  • Target

    QUOTATION_NOVQTRA071244úPDF.scr

  • Size

    331KB

  • MD5

    5287698c5838c217c8330670920d1f22

  • SHA1

    61d94cd397d56e87a13207f680f88fdf829eef71

  • SHA256

    852c78744e828250542bb9ddf2d7f2797c5613d2ab69cbd0faff944469d2c03b

  • SHA512

    4a2a295344a3842c9913e7fc0050b53cbb2733fd91019136212f9094351daf4bdac9ad3bdd989b19fbb186bd21404153ac96847269b1b988b70aa9a60f7d9d19

  • SSDEEP

    768:gl7ult3Qg2ZzEjss2VSg1I1cn0sspAgpq8hLyg1uMN0+dzsRs+eEH:+uLQ7qPpqOLy0uyL+fH

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    gator3220.hostgator.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    G!!HFpD@N*]*nF

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244úPDF.scr
    "C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244úPDF.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1580-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

    Filesize

    4KB

  • memory/1580-1-0x00000000011A0000-0x00000000011F6000-memory.dmp

    Filesize

    344KB

  • memory/1580-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-3-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

    Filesize

    4KB

  • memory/1580-4-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-5-0x000000001D330000-0x000000001D43C000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-9-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-6-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-7-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-11-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-13-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-15-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-17-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-19-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-21-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-23-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-26-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-35-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-33-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-31-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-30-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-27-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-37-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-41-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-43-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-45-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-39-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-55-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-65-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-47-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-69-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-67-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-63-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-61-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-59-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-57-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-53-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-52-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-1156-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-49-0x000000001D330000-0x000000001D436000-memory.dmp

    Filesize

    1.0MB

  • memory/1580-1157-0x000000001ABF0000-0x000000001AC6A000-memory.dmp

    Filesize

    488KB

  • memory/1580-1158-0x0000000002680000-0x00000000026CC000-memory.dmp

    Filesize

    304KB

  • memory/1580-1159-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-1160-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-1161-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-1162-0x000000001BA00000-0x000000001BA54000-memory.dmp

    Filesize

    336KB

  • memory/1580-1164-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/1580-1165-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/4948-1166-0x0000000000060000-0x0000000000088000-memory.dmp

    Filesize

    160KB

  • memory/4948-1167-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

    Filesize

    4KB

  • memory/4948-1168-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/4948-1169-0x0000000000BD0000-0x0000000000BF4000-memory.dmp

    Filesize

    144KB

  • memory/4948-1170-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/4948-1171-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/4948-1172-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/4948-1173-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB

  • memory/4948-1174-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

    Filesize

    9.9MB