Analysis
- max time kernel
129s - max time network
131s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
06/08/2025, 13:20
General
- Target DOT09876545678900.exe
- Size 574KB
- Sample250806-qlebda1lt8
- SHA256 6bfefb0f3b8a878aec69c3d830824c3bf7d5181ffd6d6e88dc4a8d793370c233
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.vipekspertiz.net
-
Port
587
-
Username
-
Password
Vipeks2023!
-
Email to
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Snakekeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOT09876545678900.exe"C:\Users\Admin\AppData\Local\Temp\DOT09876545678900.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DOT09876545678900.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JkKDRyHlZm.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JkKDRyHlZm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBE2F.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\DOT09876545678900.exe"C:\Users\Admin\AppData\Local\Temp\DOT09876545678900.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_sal4zirp.0d0.ps1
tmpBE2F.tmp
memory/112-5-0x00000000051C0000-0x00000000051CE000-memory.dmp
memory/112-3-0x0000000005200000-0x0000000005210000-memory.dmp
memory/112-6-0x0000000005200000-0x0000000005210000-memory.dmp
memory/112-7-0x0000000006C20000-0x0000000006C8C000-memory.dmp
memory/112-8-0x0000000006A50000-0x0000000006AEC000-memory.dmp
memory/112-1-0x0000000005570000-0x0000000005B16000-memory.dmp
memory/112-0-0x00000000004D0000-0x0000000000566000-memory.dmp
memory/112-2-0x0000000005060000-0x00000000050F2000-memory.dmp
memory/112-4-0x0000000005020000-0x000000000502A000-memory.dmp
memory/2660-71-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/2660-17-0x0000000002B50000-0x0000000002B60000-memory.dmp
memory/2660-72-0x0000000007A00000-0x0000000007A08000-memory.dmp
memory/2660-55-0x0000000070C00000-0x0000000070C4C000-memory.dmp
memory/2660-70-0x0000000007910000-0x0000000007925000-memory.dmp
memory/2660-68-0x00000000078D0000-0x00000000078E1000-memory.dmp
memory/2660-67-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/4912-78-0x00000000066E0000-0x0000000006730000-memory.dmp
memory/4912-22-0x0000000000400000-0x0000000000426000-memory.dmp
memory/4912-79-0x0000000006900000-0x0000000006AC2000-memory.dmp
memory/6128-15-0x00000000052C0000-0x00000000052D0000-memory.dmp
memory/6128-44-0x0000000070C00000-0x0000000070C4C000-memory.dmp
memory/6128-53-0x0000000006A70000-0x0000000006A8E000-memory.dmp
memory/6128-54-0x0000000007450000-0x00000000074F4000-memory.dmp
memory/6128-43-0x0000000006A30000-0x0000000006A64000-memory.dmp
memory/6128-65-0x00000000077B0000-0x00000000077CA000-memory.dmp
memory/6128-64-0x0000000007DF0000-0x000000000846A000-memory.dmp
memory/6128-66-0x0000000007830000-0x000000000783A000-memory.dmp
memory/6128-42-0x00000000064F0000-0x000000000653C000-memory.dmp
memory/6128-41-0x0000000006460000-0x000000000647E000-memory.dmp
memory/6128-69-0x00000000079F0000-0x00000000079FE000-memory.dmp
memory/6128-24-0x0000000006010000-0x0000000006367000-memory.dmp
memory/6128-20-0x0000000005700000-0x0000000005766000-memory.dmp
memory/6128-21-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/6128-19-0x00000000054E0000-0x0000000005502000-memory.dmp
memory/6128-16-0x0000000005900000-0x0000000005F2A000-memory.dmp
memory/6128-13-0x0000000002C50000-0x0000000002C86000-memory.dmp
memory/6128-14-0x00000000052C0000-0x00000000052D0000-memory.dmp