snakekeylogger | a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
Size

1.1MB
MD5

b4c98a79ece4709578cb71687dd964ef
SHA1

eb46ffca99c82668f5dae7f3097d103d8254bf2c
SHA256

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947
SHA512

e5f19a3acb38789f429d0dcce061498aa5c3083c5da56aa9a27e1951b23f892366f404658a5e84ffcd517cd42fa67adc86ab46236d3bcf925f85499c5d99f31c
SSDEEP

24576:gAHnh+eWsN3skA4RV1Hom2KXMmHa3xpvrd1TpY2zntv7UrIGwOn5:Xh+ZkldoPK8Ya3xhTLzntvgrIg

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2672-39-0x0000000000230000-0x000000000026A000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-42-0x00000000002A0000-0x00000000002D8000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-50-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-60-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-104-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-102-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-100-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-98-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-96-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-94-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-92-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-90-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-88-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-86-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-84-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-82-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-80-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-78-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-76-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-74-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-72-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-70-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-68-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-66-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-64-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-62-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-58-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-56-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-54-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-52-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-48-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-46-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-45-0x00000000002A0000-0x00000000002D3000-memory.dmp	family_snakekeylogger

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2672-39-0x0000000000230000-0x000000000026A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-42-0x00000000002A0000-0x00000000002D8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-50-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-60-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-104-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-102-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-100-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-98-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-96-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-94-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-92-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-90-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-88-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-86-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-84-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-82-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-80-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-78-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-76-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-74-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-72-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-70-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-68-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-66-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-64-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-62-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-58-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-56-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-54-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-52-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-48-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-46-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2672-45-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2672-39-0x0000000000230000-0x000000000026A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-42-0x00000000002A0000-0x00000000002D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-50-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-60-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-104-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-102-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-100-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-98-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-96-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-94-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-92-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-90-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-88-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-86-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-84-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-82-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-80-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-78-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-76-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-74-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-72-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-70-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-68-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-66-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-64-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-62-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-58-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-56-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-54-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-52-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-48-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-46-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2672-45-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables with potential process hoocking 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2672-39-0x0000000000230000-0x000000000026A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-42-0x00000000002A0000-0x00000000002D8000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-50-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-60-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-104-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-102-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-100-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-98-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-96-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-94-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-92-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-90-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-88-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-86-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-84-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-82-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-80-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-78-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-76-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-74-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-72-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-70-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-68-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-66-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-64-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-62-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-58-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-56-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-54-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-52-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-48-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-46-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
behavioral1/memory/2672-45-0x00000000002A0000-0x00000000002D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Drops startup file 1 IoCs

Processes:

reenjoys.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reenjoys.vbs reenjoys.exe
Executes dropped EXE 1 IoCs

Processes:

reenjoys.exe

pid process

2368 reenjoys.exe
Loads dropped DLL 6 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exeWerFault.exe

pid process

3068 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
2572 WerFault.exe
2572 WerFault.exe
2572 WerFault.exe
2572 WerFault.exe
2572 WerFault.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reenjoys.vbs	reenjoys.exe

pid	process
2368	reenjoys.exe

pid	process
3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe
2572	WerFault.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe autoit_exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

reenjoys.exe

description pid process target process

PID 2368 set thread context of 2672 2368 reenjoys.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 2368 WerFault.exe reenjoys.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2672 RegSvcs.exe
2672 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

reenjoys.exe

pid process

2368 reenjoys.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2672 RegSvcs.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exereenjoys.exe

pid process

3068 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
3068 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
2368 reenjoys.exe
2368 reenjoys.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exereenjoys.exe

pid process

3068 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
3068 a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
2368 reenjoys.exe
2368 reenjoys.exe

flow	ioc
4	checkip.dyndns.org

resource	yara_rule
\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe	autoit_exe

description	pid	process	target process
PID 2368 set thread context of 2672	2368	reenjoys.exe	RegSvcs.exe

pid	pid_target	process	target process
2572	2368	WerFault.exe	reenjoys.exe

pid	process
2672	RegSvcs.exe
2672	RegSvcs.exe

pid	process
2368	reenjoys.exe

description	pid	process
Token: SeDebugPrivilege	2672	RegSvcs.exe

pid	process
3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
2368	reenjoys.exe
2368	reenjoys.exe

pid	process
3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
2368	reenjoys.exe
2368	reenjoys.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exereenjoys.exe

description	pid	process	target process
PID 3068 wrote to memory of 2368	3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 3068 wrote to memory of 2368	3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 3068 wrote to memory of 2368	3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 3068 wrote to memory of 2368	3068	a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe	reenjoys.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2672	2368	reenjoys.exe	RegSvcs.exe
PID 2368 wrote to memory of 2572	2368	reenjoys.exe	WerFault.exe
PID 2368 wrote to memory of 2572	2368	reenjoys.exe	WerFault.exe
PID 2368 wrote to memory of 2572	2368	reenjoys.exe	WerFault.exe
PID 2368 wrote to memory of 2572	2368	reenjoys.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe
"C:\Users\Admin\AppData\Local\Temp\a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe
"C:\Users\Admin\AppData\Local\Temp\a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 320
3⤵
- Loads dropped DLL
- Program crash
PID:2572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lecheries
Filesize
28KB

MD5
6be1e9f61d5b594391fba627a7da1186

SHA1
3f05f8e116d5068e0809dc425a66983431bfa221

SHA256
80c7e9bf4ad702bc9e7d642800d963b927ffcae197535bc5b59cd3af3f6e7e3f

SHA512
f061afa41029c571bf1885cec9a48da2197e2bd0036a1788b2d32aa99ad0d905c05e2607859325710137950d5b62d55c45d1cbf4b8db827ea9e5ade4f7ca77cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\peaks
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\acrorrheuma\reenjoys.exe
Filesize
1.1MB

MD5
b4c98a79ece4709578cb71687dd964ef

SHA1
eb46ffca99c82668f5dae7f3097d103d8254bf2c

SHA256
a5fd3881443c22686f44f95392f2ad3645e2ce59868df87078be5f825c1fa947

SHA512
e5f19a3acb38789f429d0dcce061498aa5c3083c5da56aa9a27e1951b23f892366f404658a5e84ffcd517cd42fa67adc86ab46236d3bcf925f85499c5d99f31c

Download Submit
memory/2672-30-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2672-32-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2672-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2672-38-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2672-39-0x0000000000230000-0x000000000026A000-memory.dmp

Filesize
232KB

Download
memory/2672-41-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-42-0x00000000002A0000-0x00000000002D8000-memory.dmp

Filesize
224KB

Download
memory/2672-43-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-44-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-50-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-60-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-104-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-102-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-631-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-100-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-98-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-96-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-94-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-92-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-90-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-88-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-86-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-84-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-82-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-80-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-78-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-76-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-74-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-72-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-70-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-68-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-66-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-64-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-62-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-58-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-56-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-54-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-52-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-48-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-46-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-45-0x00000000002A0000-0x00000000002D3000-memory.dmp

Filesize
204KB

Download
memory/2672-632-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2672-633-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2672-634-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-635-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-636-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2672-637-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-10-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download