Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
Product list Quotation.zip
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Product list Quotation.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Product list Quotation.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Product list Quotation.exe
Resource
win10v2004-20240508-en
General
-
Target
Product list Quotation.exe
-
Size
537KB
-
MD5
686765a9837993bcd537f331618ca760
-
SHA1
076f9efc6fec1075f83adbfcd5c659ccde48341d
-
SHA256
63dbe7d557dc8b87937890df261f61ee69b5c6354aed54d5611baa3e93f66e8e
-
SHA512
afacb63926fafc52b937194ea2c51ea147157c88ceaf11b37409a1f0faf97121e93711d1acf9be2eb20d2bf7fd7fda8b5275735e4b1488b5d80b7830343ff770
-
SSDEEP
12288:/lxGPX90OoD9WTcAycaYUDXKrDU0JxxJv/v+FLuSn:m+9WISa1JMxvv/gLB
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.valleycountysar.org - Port:
587 - Username:
[email protected] - Password:
DKw(r0%wpbd]
http://103.130.147.85
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 5 IoCs
Processes:
resource yara_rule behavioral3/memory/2200-11-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2200-8-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2200-7-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2200-15-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger behavioral3/memory/2200-13-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2652 cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Product list Quotation.exedescription pid process target process PID 2232 set thread context of 2200 2232 Product list Quotation.exe Product list Quotation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Product list Quotation.exepid process 2200 Product list Quotation.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Product list Quotation.exedescription pid process Token: SeDebugPrivilege 2200 Product list Quotation.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Product list Quotation.exeProduct list Quotation.execmd.exedescription pid process target process PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2232 wrote to memory of 2200 2232 Product list Quotation.exe Product list Quotation.exe PID 2200 wrote to memory of 2652 2200 Product list Quotation.exe cmd.exe PID 2200 wrote to memory of 2652 2200 Product list Quotation.exe cmd.exe PID 2200 wrote to memory of 2652 2200 Product list Quotation.exe cmd.exe PID 2200 wrote to memory of 2652 2200 Product list Quotation.exe cmd.exe PID 2652 wrote to memory of 2908 2652 cmd.exe choice.exe PID 2652 wrote to memory of 2908 2652 cmd.exe choice.exe PID 2652 wrote to memory of 2908 2652 cmd.exe choice.exe PID 2652 wrote to memory of 2908 2652 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Product list Quotation.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2200-13-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2200-16-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2200-7-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2200-19-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2200-6-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2200-11-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2200-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2200-5-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2200-17-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2200-15-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2200-8-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2232-4-0x0000000000480000-0x0000000000488000-memory.dmpFilesize
32KB
-
memory/2232-0-0x00000000741CE000-0x00000000741CF000-memory.dmpFilesize
4KB
-
memory/2232-1-0x0000000000DD0000-0x0000000000E5C000-memory.dmpFilesize
560KB
-
memory/2232-2-0x0000000000660000-0x00000000006B4000-memory.dmpFilesize
336KB
-
memory/2232-18-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB
-
memory/2232-3-0x00000000741C0000-0x00000000748AE000-memory.dmpFilesize
6.9MB