Analysis
-
max time kernel
95s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-12-2024 04:01
General
-
Target
d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe
-
Size
713KB
-
MD5
223c59e071cfa0c3931a18df26669606
-
SHA1
666735c53a6fe5569d61598b5769f180089957ba
-
SHA256
d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075
-
SHA512
671a4c67c49b722ac0b971b122d4a5724ce05ee87e4dd05f6d8c7cccc89e0c23b30e3d482d4dc564f2c1a977b0e4787d01663c46f7680444c613860d8f3355af
-
SSDEEP
12288:XJEm10Qb/p87R9ZUH4PJZhr3MKnkUqwSlJZRQbLv5BnPg5qC3hnuMd9A3Fu:XJT1jzp87RsHSfhDMKnkUTgZGLvbPKqI
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
-
Snakekeylogger family
-
Executes dropped EXE 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe"C:\Users\Admin\AppData\Local\Temp\d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zhwhki.exe"C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zhwhki.exe"C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD501eabf752d917ea6bc3e83563d640368
SHA1dff891efb9de9dcda0cf5ddf89bca67b4a8c8f30
SHA256e50d59e6aece1387c1ff5fb6f50e67f356b07955e52326f0a19989e7c677e48e
SHA5126e71efac490655e85264481f9ddecdd2748105b3620eb0fccf27f0eeebbfa1bda7b9dd8f186fa3ada1606fd87157a51642a163d7896c9e55d1db12d58253e3a2
-
Filesize
6KB
MD5cea25eafec4235e42120c4492dc98b5c
SHA1fa9a75cc2cdea3d78241b2b48573f0d7b75e9bc3
SHA256dde1986fe665769b139c1f90acde795ba56c87d3cf919cde2d17ba2a65f1a47b
SHA512dbe16e29af68d885790bf01b8f72de1879714ddc0f9e939fd169b5507966fc91df96de6c0dc1110482e16f7f1eeca0f9e5c546d151686b1251790e6197ffbc50
-
Filesize
925KB
MD50adb9b817f1df7807576c2d7068dd931
SHA14a1b94a9a5113106f40cd8ea724703734d15f118
SHA25698e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
SHA512883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a
-
Filesize
205KB
MD5c4ad82ba37dbdb7e89edece563b3c1ff
SHA14eeccaee473845b06d8673bc3efefc1a00ef1ea2
SHA25610631ac0a6e56ebfe89c9104add048e329b5cefab124248144d13a5335639614
SHA5122f971d4645a1704f7507b14c0031967a2355038f7ac439fa6750c7771b58572921be72281802097d1250e7da504fea620115f1d25352ee05ffe6d1ab01a9645e
-
Filesize
8KB
-
Filesize
152KB
-
Filesize
624KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
220KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB