Analysis
-
max time kernel
121s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-02-2025 04:56
General
-
Target
newwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.exe
-
Size
652KB
-
MD5
a43a4806314ffe1f7c12b70d5e67166d
-
SHA1
86ff15c0da292046c678c7ca0f1d41da4d7e26a8
-
SHA256
1d894e62095e10035f72fe5a081a4762247363d1ff9829b1d198cf992d0e04d2
-
SHA512
1823fbec230799c35ff89dac236cc81947e41aac6fb8c7ccc6bd9c96866d2de14c584baece197ac324c578fb396b52d9ffd4beec6b38e911be3f12b4667d9ab8
-
SSDEEP
12288:jfTbnb4QzjVHnLM2IQcJhRsX8evMVMj9ocqpsQAHMKZ:33Vtass4MmIyQe
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5227573794:AAECZBnQSxLs0aOVsV2wnclC6-WKnxPpi_k/sendMessage?chat_id=5217421430
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
-
Snakekeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\newwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.exe"C:\Users\Admin\AppData\Local\Temp\newwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\newwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zfHIXJgU.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zfHIXJgU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8797.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\newwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.exe"C:\Users\Admin\AppData\Local\Temp\newwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b3b381c9fc8828c940a54495e245eb15
SHA12b18f446c1e43f1a036bd65be11e5a32885c815c
SHA25691da40518c25c32917633acd9acc3fc24af1fdcbf3058d81756a52e8fd159b8c
SHA512ad9e2bd7d3fd61dc9fbc910ce9aedcdd46c60f298afd7dcaf61bcb8c11386520efb97c82d45d809b51c4e9a76a12116d5cb67256560751079bb7d6c148aa3495
-
Filesize
7KB
MD57450105a2937ef113c593f1acbe08864
SHA104dfa893ff47c10a422f09858d7e6815cff8785a
SHA256f24b2b09f33f4526669eb5549b42cbae685fcce8b193049112e0a7924116f7ed
SHA51250ad278d95091fca0de67767f4b28214d8396b4c935c8f151c4fab22e3c8e4f12ec99898e52bd3c93524873969fc305935597ed5748673193aefa405eda0bff1
-
Filesize
4KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
432KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB