Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 09:47

General

  • Target

    d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe

  • Size

    595KB

  • MD5

    4a15ed0feb9e90b56e82c2e45a3b3f5e

  • SHA1

    659661291eb5fd6452d6cabdc24cd9fbc1fb17f7

  • SHA256

    d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec

  • SHA512

    f5c0e6fd93018b454db12ef76b10a6feeca5d532a7599a6460d00c1870518752fb4ec0bc1052de34e6d4e18e040658d59037a757232f49731264b81c5fe32fed

  • SSDEEP

    12288:VWjK4A9bRiI5VIfzhXLhZnFLsrPmaj015WWn9QNViWeCT+GCqR:AjKRByzhFErOaj0x9uiWeCtCq

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://cpanel2-nl.thcservers.com/
  • Port:
    21
  • Username:
    Yx74dJ0TP3M=
  • Password:
    Uvob2G1Tc73ZCus02X

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 5 IoCs
  • Snakekeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe
    "C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oGnCNPiCwiAocn.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oGnCNPiCwiAocn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB4.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2856
    • C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe
      "C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe"
      2⤵
        PID:2652
      • C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe
        "C:\Users\Admin\AppData\Local\Temp\d5d8c33957e90d1caca4b5207d8da5ab1bc4caa9f702abc0ec006d0518ea9aec.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2524

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpBB4.tmp

      Filesize

      1KB

      MD5

      6e01ef1465a858e31ff01f9a8d169d62

      SHA1

      38a56af0e42e2cc8d6a81809515eb8db29aed67c

      SHA256

      d54409786ba98bc2dc035a871866cb7c8a702e1caedec43a87032535f65107fc

      SHA512

      c2875b297e70acd3b1a39a43f3294c91f4ca42dd693d3564204da8987a2543b338df32e3a41cbd3b37fb668666739d23c7d89e7d4c46d1e247654a432442cb43

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      8eaf890884cd09d2cbafdae585343b12

      SHA1

      e1f0757842c3d356dc8f853ccc28cccf835d78fa

      SHA256

      2c367b11a40baa00d3cac055f14a3541e9ce4f04ccf9bbcc91a5fd17f359b158

      SHA512

      8a10dc116520c1223dcaa7a60bb326b53ed6f5ab6eea0b643d3d5e45e694a6fe8e9a7e0c7e0e59a73fd9481382419bb6810eed758ce30256fa1ad4a5bf24dec4

    • memory/2328-4-0x00000000748CE000-0x00000000748CF000-memory.dmp

      Filesize

      4KB

    • memory/2328-31-0x00000000748C0000-0x0000000074FAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2328-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

      Filesize

      4KB

    • memory/2328-5-0x00000000748C0000-0x0000000074FAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2328-6-0x0000000004D70000-0x0000000004DDC000-memory.dmp

      Filesize

      432KB

    • memory/2328-2-0x00000000748C0000-0x0000000074FAE000-memory.dmp

      Filesize

      6.9MB

    • memory/2328-1-0x0000000000840000-0x00000000008DC000-memory.dmp

      Filesize

      624KB

    • memory/2328-3-0x0000000000250000-0x0000000000262000-memory.dmp

      Filesize

      72KB

    • memory/2524-28-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2524-29-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2524-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2524-25-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2524-23-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2524-21-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2524-19-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/2524-30-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB