Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 01:20
Static task
static1
Behavioral task
behavioral1
Sample
Contract.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Contract.exe
Resource
win10v2004-20240508-en
General
-
Target
Contract.exe
-
Size
563KB
-
MD5
8c2f569ddc16f61e8c7b053cbd94f0b4
-
SHA1
585691bd7c15100b16bc3c49f94a9f9cf9c86477
-
SHA256
f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9
-
SHA512
ed3a9205c4df6c3531bfa974249face667414a4932862967254a83e0e63bdd7dc95fb79210636f023dd984e15dbc1e65a51226fc1ecfb08f1cbe3d3950d45ee0
-
SSDEEP
12288:aTOvjSANT3ukfoCJU0/Q0P3H0Nho+EHl00DE64MoQksBl7jMkZQV:aT2jFT3ukNJNPXQAHKeEXMx7Qmm
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.speedhouseoman.com - Port:
587 - Username:
[email protected] - Password:
SpH@0084
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3932-29-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Contract.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Contract.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Contract.exedescription pid process target process PID 4904 set thread context of 3932 4904 Contract.exe Contract.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5076 3932 WerFault.exe Contract.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeContract.exepid process 2980 powershell.exe 2980 powershell.exe 3932 Contract.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeContract.exedescription pid process Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 3932 Contract.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Contract.exedescription pid process target process PID 4904 wrote to memory of 2980 4904 Contract.exe powershell.exe PID 4904 wrote to memory of 2980 4904 Contract.exe powershell.exe PID 4904 wrote to memory of 2980 4904 Contract.exe powershell.exe PID 4904 wrote to memory of 1668 4904 Contract.exe schtasks.exe PID 4904 wrote to memory of 1668 4904 Contract.exe schtasks.exe PID 4904 wrote to memory of 1668 4904 Contract.exe schtasks.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe PID 4904 wrote to memory of 3932 4904 Contract.exe Contract.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Contract.exe"C:\Users\Admin\AppData\Local\Temp\Contract.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vgTSRopQheAdCk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vgTSRopQheAdCk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp755F.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\Contract.exe"C:\Users\Admin\AppData\Local\Temp\Contract.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 14523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3932 -ip 39321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fqlhjlm.j2e.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp755F.tmpFilesize
1KB
MD51b1d3cc927ec28d2a9dbb3565bcaf3b8
SHA1d4761d5eef7cfac107f8e729d3819cc58260dc28
SHA2568a4d691df701ae1351f944838e2537088c8ed04ebf73ab08a33083a318d47217
SHA512327bc9f5ff9a7ae9944d298daa183b749e169a6038eaba3eeb24f1d79ab6325e75ccc1587d2615e6523a1deabf405272e9732d9369b6b832347de876a66dce19
-
memory/2980-17-0x00000000059C0000-0x0000000005FE8000-memory.dmpFilesize
6.2MB
-
memory/2980-40-0x0000000074F00000-0x0000000074F4C000-memory.dmpFilesize
304KB
-
memory/2980-58-0x0000000007D50000-0x0000000007D64000-memory.dmpFilesize
80KB
-
memory/2980-57-0x0000000007D40000-0x0000000007D4E000-memory.dmpFilesize
56KB
-
memory/2980-56-0x0000000007D10000-0x0000000007D21000-memory.dmpFilesize
68KB
-
memory/2980-55-0x0000000007D90000-0x0000000007E26000-memory.dmpFilesize
600KB
-
memory/2980-54-0x0000000007B80000-0x0000000007B8A000-memory.dmpFilesize
40KB
-
memory/2980-53-0x0000000007B10000-0x0000000007B2A000-memory.dmpFilesize
104KB
-
memory/2980-52-0x0000000008160000-0x00000000087DA000-memory.dmpFilesize
6.5MB
-
memory/2980-16-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2980-38-0x00000000068D0000-0x000000000691C000-memory.dmpFilesize
304KB
-
memory/2980-59-0x0000000007E50000-0x0000000007E6A000-memory.dmpFilesize
104KB
-
memory/2980-20-0x0000000005730000-0x0000000005752000-memory.dmpFilesize
136KB
-
memory/2980-60-0x0000000007E30000-0x0000000007E38000-memory.dmpFilesize
32KB
-
memory/2980-18-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2980-21-0x00000000057D0000-0x0000000005836000-memory.dmpFilesize
408KB
-
memory/2980-22-0x0000000005940000-0x00000000059A6000-memory.dmpFilesize
408KB
-
memory/2980-63-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2980-51-0x00000000077E0000-0x0000000007883000-memory.dmpFilesize
652KB
-
memory/2980-50-0x0000000007760000-0x000000000777E000-memory.dmpFilesize
120KB
-
memory/2980-24-0x00000000061B0000-0x0000000006504000-memory.dmpFilesize
3.3MB
-
memory/2980-15-0x0000000005240000-0x0000000005276000-memory.dmpFilesize
216KB
-
memory/2980-37-0x00000000067F0000-0x000000000680E000-memory.dmpFilesize
120KB
-
memory/2980-39-0x00000000077A0000-0x00000000077D2000-memory.dmpFilesize
200KB
-
memory/3932-29-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/3932-64-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/3932-35-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/4904-7-0x0000000005690000-0x00000000056AA000-memory.dmpFilesize
104KB
-
memory/4904-10-0x000000000C070000-0x000000000C0D8000-memory.dmpFilesize
416KB
-
memory/4904-9-0x000000000C060000-0x000000000C06C000-memory.dmpFilesize
48KB
-
memory/4904-8-0x0000000005670000-0x0000000005678000-memory.dmpFilesize
32KB
-
memory/4904-36-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/4904-6-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/4904-5-0x0000000005300000-0x000000000539C000-memory.dmpFilesize
624KB
-
memory/4904-4-0x0000000005210000-0x000000000521A000-memory.dmpFilesize
40KB
-
memory/4904-3-0x0000000005040000-0x00000000050D2000-memory.dmpFilesize
584KB
-
memory/4904-2-0x00000000056C0000-0x0000000005C64000-memory.dmpFilesize
5.6MB
-
memory/4904-1-0x00000000005D0000-0x0000000000662000-memory.dmpFilesize
584KB
-
memory/4904-0-0x000000007465E000-0x000000007465F000-memory.dmpFilesize
4KB