Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 16:14
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
1.1MB
-
MD5
011f3bebde38bdac8ceaebfbff201f4a
-
SHA1
bb5769d029c5f202e823e038aab2aae454cf0299
-
SHA256
b6ad170d197d557e308b9356d0f87653eb463cf74a48cbb50ce74c7260c315c2
-
SHA512
161838d1df3f6b7d7c2d61f98fc5fc55a30281e24433a5fc49a52aad0182bd5c5d581ba294c2a96878d93dc8536499d79a08f8aac879dc0eb5bee7f46b429cdf
-
SSDEEP
12288:a93TVasGFa3nj6mYdrlXeohkdm8odEH8o4+AJDYv+6c0xlskR:a9l53jVYRXebsf19DEJ/
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7971510363:AAH477ofdLYaboEb0PeeyOtbxApvVZT953M/sendMessage?chat_id=7405587880
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
resource yara_rule behavioral1/memory/2736-26-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2736-25-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2736-24-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2736-21-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral1/memory/2736-19-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1824 powershell.exe -
Uses the VBS compiler for execution 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3044 set thread context of 2736 3044 file.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2752 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2736 vbc.exe 1824 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2736 vbc.exe Token: SeDebugPrivilege 1824 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1824 3044 file.exe 31 PID 3044 wrote to memory of 1824 3044 file.exe 31 PID 3044 wrote to memory of 1824 3044 file.exe 31 PID 3044 wrote to memory of 1824 3044 file.exe 31 PID 3044 wrote to memory of 2752 3044 file.exe 33 PID 3044 wrote to memory of 2752 3044 file.exe 33 PID 3044 wrote to memory of 2752 3044 file.exe 33 PID 3044 wrote to memory of 2752 3044 file.exe 33 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 3044 wrote to memory of 2736 3044 file.exe 35 PID 2736 wrote to memory of 1748 2736 vbc.exe 36 PID 2736 wrote to memory of 1748 2736 vbc.exe 36 PID 2736 wrote to memory of 1748 2736 vbc.exe 36 PID 2736 wrote to memory of 1748 2736 vbc.exe 36 PID 1748 wrote to memory of 1448 1748 cmd.exe 38 PID 1748 wrote to memory of 1448 1748 cmd.exe 38 PID 1748 wrote to memory of 1448 1748 cmd.exe 38 PID 1748 wrote to memory of 1448 1748 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BtnoWSiF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BtnoWSiF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFEF8.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
- System Location Discovery: System Language Discovery
PID:1448
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57981b8e59ec75386de864ebf7982f61a
SHA152ab67c414292033cc44905f2ac8a7dc0337e35c
SHA25616d436504dfdef0cd5f3b7ff1966c12303d53a4fc292de8a25d1a43582f6c1b0
SHA512b2d4c2f958548a487703a6cc65d127142319cdd48571ab0335226b217e5679e235237de9c6348467be0a3b81b58dad0f5c56f7be749d495c4c1b837ed421dc76