Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 16:16
Static task
static1
Behavioral task
behavioral1
Sample
Product list Quotation.zip
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Product list Quotation.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Product list Quotation.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Product list Quotation.exe
Resource
win10v2004-20240226-en
General
-
Target
Product list Quotation.exe
-
Size
537KB
-
MD5
f081e31b399dbf3450b468662bb4a124
-
SHA1
27385cfd3fc7796b33c2fa54e8728c67e39b44d2
-
SHA256
e855e16a669ed33674c20481a0a80dc4c6b77e50c0091a1f852a655336a5dd1e
-
SHA512
97056229574e32de6e63162767fdf261bc7b5a3188c072dd0f416f238e46cb3a096d8f7dfc8b0c358f2c0156303910ebf67909f36fd350dc2de5201ce4184267
-
SSDEEP
12288:/F2QYt9sMIqiTxNEz3AcdYMGJv/v+CLuSn:t2QEv0jEjDEv/HLB
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.valleycountysar.org - Port:
587 - Username:
[email protected] - Password:
DKw(r0%wpbd]
http://103.130.147.85
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral3/memory/2128-10-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2128-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2128-17-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2128-15-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2128-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2848 cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Product list Quotation.exedescription pid process target process PID 2192 set thread context of 2128 2192 Product list Quotation.exe Product list Quotation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Product list Quotation.exepid process 2128 Product list Quotation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Product list Quotation.exedescription pid process Token: SeDebugPrivilege 2128 Product list Quotation.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Product list Quotation.exeProduct list Quotation.execmd.exedescription pid process target process PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2192 wrote to memory of 2128 2192 Product list Quotation.exe Product list Quotation.exe PID 2128 wrote to memory of 2848 2128 Product list Quotation.exe cmd.exe PID 2128 wrote to memory of 2848 2128 Product list Quotation.exe cmd.exe PID 2128 wrote to memory of 2848 2128 Product list Quotation.exe cmd.exe PID 2128 wrote to memory of 2848 2128 Product list Quotation.exe cmd.exe PID 2848 wrote to memory of 2260 2848 cmd.exe choice.exe PID 2848 wrote to memory of 2260 2848 cmd.exe choice.exe PID 2848 wrote to memory of 2260 2848 cmd.exe choice.exe PID 2848 wrote to memory of 2260 2848 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2128-7-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2128-18-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB
-
memory/2128-17-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2128-21-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB
-
memory/2128-15-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2128-5-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2128-10-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2128-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2128-19-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB
-
memory/2128-9-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2128-13-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2192-4-0x0000000000330000-0x0000000000338000-memory.dmpFilesize
32KB
-
memory/2192-0-0x000000007477E000-0x000000007477F000-memory.dmpFilesize
4KB
-
memory/2192-1-0x0000000000EC0000-0x0000000000F4C000-memory.dmpFilesize
560KB
-
memory/2192-2-0x00000000003D0000-0x0000000000424000-memory.dmpFilesize
336KB
-
memory/2192-20-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB
-
memory/2192-3-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB