Analysis
-
max time kernel
138s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
27/03/2025, 01:19
General
-
Target
details0009872025.exe
-
Size
1.1MB
-
MD5
a6d2fdd58e05f6de2c210da112ae8c75
-
SHA1
397b37b53406e6f986bdbff058a2f426326a4820
-
SHA256
7595b7d062b81812a6dd7cc3944d9ed0a8893b711e96ca429bb87c2936b2fe60
-
SHA512
f459dce57461e555390a2168a3848b126f61c1e7ec212d78ba2c221e8fa0a44cd371c5fb669a18a24448a04dedf5d037a1de1138f84008a36c803abc1a70c5ff
-
SSDEEP
24576:uu6J33O0c+JY5UZ+XC0kGso6Fa9QuPafX1twgMHvLlaRWY:gu0c++OCvkGs9Fa9RafXIHvprY
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 34 IoCs
-
Snakekeylogger family
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\details0009872025.exe"C:\Users\Admin\AppData\Local\Temp\details0009872025.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\buncal\robustuous.exe"C:\Users\Admin\AppData\Local\Temp\details0009872025.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\details0009872025.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a6d2fdd58e05f6de2c210da112ae8c75
SHA1397b37b53406e6f986bdbff058a2f426326a4820
SHA2567595b7d062b81812a6dd7cc3944d9ed0a8893b711e96ca429bb87c2936b2fe60
SHA512f459dce57461e555390a2168a3848b126f61c1e7ec212d78ba2c221e8fa0a44cd371c5fb669a18a24448a04dedf5d037a1de1138f84008a36c803abc1a70c5ff
-
Filesize
4.0MB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
224KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
624KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
7.7MB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
4.0MB