Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 09:41
General
- Target 2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_el.exe
- Size 332KB
- Sample260703-ln48csew8x
- SHA256 ed27063c0309aadece97d349afb376404325000af716b3ba90406e214e9af0e4
Malware Config
Extracted
-
snakekeylogger
-
Protocol
ftp
-
Host
ftp://ftp.resultboxx.xyz/
-
Port
21
-
Username
-
Password
workhard123#
Signatures
- Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Snake Keylogger payload 2 IoCs
- Warzone RAT payload 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
- Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 2 IoCs
- Detects executables using Telegram Chat Bot 2 IoCs
- Detects executables with potential process hoocking 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 3 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_el.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_f485352f9184c62ca14a4345b891a061_404-keylogger_amadey_ave-maria_bazarbackdoor_darkgate_el.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NKECHI.EXE"C:\Users\Admin\AppData\Local\Temp\NKECHI.EXE"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Users\Admin\AppData\Local\Temp\NOW.EXE"C:\Users\Admin\AppData\Local\Temp\NOW.EXE"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
NKECHI.EXE
NOW.EXE
__PSScriptPolicyTest_4o2jvtyv.01w.ps1
memory/692-45-0x0000000006410000-0x0000000006430000-memory.dmp
memory/692-38-0x0000000005E30000-0x0000000005E7C000-memory.dmp
memory/692-50-0x00000000073F0000-0x0000000007486000-memory.dmp
memory/692-26-0x0000000004980000-0x00000000049B6000-memory.dmp
memory/692-27-0x0000000005010000-0x000000000565A000-memory.dmp
memory/692-29-0x0000000005850000-0x00000000058B6000-memory.dmp
memory/692-28-0x0000000004FC0000-0x0000000004FE2000-memory.dmp
memory/692-30-0x00000000058C0000-0x0000000005926000-memory.dmp
memory/692-33-0x0000000005930000-0x0000000005C8B000-memory.dmp
memory/692-49-0x00000000071F0000-0x00000000071FA000-memory.dmp
memory/692-48-0x0000000007180000-0x000000000719A000-memory.dmp
memory/692-47-0x00000000077D0000-0x0000000007E4C000-memory.dmp
memory/692-37-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/692-46-0x0000000006E50000-0x0000000006EF3000-memory.dmp
memory/692-42-0x0000000074940000-0x000000007498C000-memory.dmp
memory/692-41-0x0000000006DE0000-0x0000000006E16000-memory.dmp
memory/3980-53-0x0000000074940000-0x000000007498C000-memory.dmp
memory/5288-20-0x0000000005700000-0x0000000005CBA000-memory.dmp
memory/5288-19-0x0000000000600000-0x0000000000626000-memory.dmp
memory/5288-21-0x00000000051E0000-0x000000000527C000-memory.dmp
memory/5288-36-0x0000000006430000-0x000000000643A000-memory.dmp
memory/5288-35-0x0000000006680000-0x0000000006712000-memory.dmp
memory/5288-34-0x00000000064B0000-0x0000000006672000-memory.dmp
memory/5288-22-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5288-18-0x0000000074052000-0x0000000074053000-memory.dmp
memory/5288-59-0x0000000074040000-0x00000000747FC000-memory.dmp
memory/5492-51-0x0000000001210000-0x0000000001211000-memory.dmp