Extracted

• • Target

    b416b3cd07533aa1e3f322bbf904be65df03dcf08507ef9a683271a3c4848025.xlsx

  • Size

    438KB

  • MD5

    9bf51f7bdf35911324a4fbb9235090f7

  • SHA1

    d1abcb2b543a4c0f308dade69d1be6a96f356a3b

  • SHA256

    b416b3cd07533aa1e3f322bbf904be65df03dcf08507ef9a683271a3c4848025

  • SHA512

    c678628535508e250605babc13d899c598ab1466294b7917d583b577fb5362346b47952d684622c445512753980329ecc513934a7391b7511f7fc1588d981aff

  • SSDEEP

    12288:Zl3PBexJxH0cZtSlOSgjG3IWNqAvfTYxv25F3:Z5PBexJJF2cSwG4ofTn55

  Score

  10^/10

  discoveryexecutionsnakekeyloggercollectionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2