| File name: | inquiry 281023 0090101091.exe |
| Full analysis: | https://app.any.run/tasks/fd796663-e32f-4dec-baf5-590c1a8be0bc |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | October 18, 2023, 16:16:24 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | 69110E7C026F12D745C9EB14457CF51E |
| SHA1: | 7DD89471735D1BFA3DD903E7AD92C29106DC4CCE |
| SHA256: | 31899311DEF16C86B9D15294FD9A2B765B4A574B79A28D70B0F3DD73B25D62F5 |
| SSDEEP: | 24576:SN2qApntBAU6kbjR8R5q0WoGzGkqpuii9:SNTAptBAdkbjR8R5q0WoGzGkqpuii9 |
MALICIOUS
Uses Task Scheduler to run other applications
- inquiry 281023 0090101091.exe (PID: 2204)
Drops the executable file immediately after the start
- inquiry 281023 0090101091.exe (PID: 2204)
Application was dropped or rewritten from another process
- inquiry 281023 0090101091.exe (PID: 2204)
- inquiry 281023 0090101091.exe (PID: 2944)
Steals credentials from Web Browsers
- inquiry 281023 0090101091.exe (PID: 2944)
Actions looks like stealing of personal data
- inquiry 281023 0090101091.exe (PID: 2944)
SNAKE has been detected (YARA)
- inquiry 281023 0090101091.exe (PID: 2944)
SNAKEKEYLOGGER was detected
- inquiry 281023 0090101091.exe (PID: 2944)
SUSPICIOUS
Reads the Internet Settings
- inquiry 281023 0090101091.exe (PID: 2204)
- inquiry 281023 0090101091.exe (PID: 2944)
Application launched itself
- inquiry 281023 0090101091.exe (PID: 2204)
Checks for external IP
- inquiry 281023 0090101091.exe (PID: 2944)
Accesses Microsoft Outlook profiles
- inquiry 281023 0090101091.exe (PID: 2944)
The process verifies whether the antivirus software is installed
- inquiry 281023 0090101091.exe (PID: 2944)
Connects to SMTP port
- inquiry 281023 0090101091.exe (PID: 2944)
INFO
Reads the computer name
- inquiry 281023 0090101091.exe (PID: 2204)
- inquiry 281023 0090101091.exe (PID: 2944)
Checks supported languages
- inquiry 281023 0090101091.exe (PID: 2204)
- inquiry 281023 0090101091.exe (PID: 2944)
Creates files or folders in the user directory
- inquiry 281023 0090101091.exe (PID: 2204)
Create files in a temporary directory
- inquiry 281023 0090101091.exe (PID: 2204)
Reads the machine GUID from the registry
- inquiry 281023 0090101091.exe (PID: 2204)
- inquiry 281023 0090101091.exe (PID: 2944)
Reads Environment values
- inquiry 281023 0090101091.exe (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
SnakeKeylogger
(PID) Process(2944) inquiry 281023 0090101091.exe
Keys
DES6fc98cd6
Options
SMTP Userarifguney@gkas.com.tr
SMTP PasswordGkasteknik@2022
SMTP Hostmail.gkas.com.tr
SMTP SendToarifguney@gkas.com.tr
SMTP Port587
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:10:17 16:40:41+02:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 906240 |
| InitializedDataSize: | 17408 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xdf2ee |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | QuanLyKhoHang |
| FileVersion: | 1.0.0.0 |
| InternalName: | lKdPDf.exe |
| LegalCopyright: | Copyright © 2017 |
| LegalTrademarks: | - |
| OriginalFileName: | lKdPDf.exe |
| ProductName: | QuanLyKhoHang |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
32
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2204 | "C:\Users\admin\AppData\Local\Temp\inquiry 281023 0090101091.exe" | C:\Users\admin\AppData\Local\Temp\inquiry 281023 0090101091.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: QuanLyKhoHang Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2572 | "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fdJXmpnyQyt" /XML "C:\Users\admin\AppData\Local\Temp\tmp712F.tmp" | C:\Windows\SysWOW64\schtasks.exe | — | inquiry 281023 0090101091.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2944 | "C:\Users\admin\AppData\Local\Temp\inquiry 281023 0090101091.exe" | C:\Users\admin\AppData\Local\Temp\inquiry 281023 0090101091.exe | inquiry 281023 0090101091.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: QuanLyKhoHang Exit code: 0 Version: 1.0.0.0 Modules
SnakeKeylogger(PID) Process(2944) inquiry 281023 0090101091.exe Keys DES6fc98cd6 Options SMTP Userarifguney@gkas.com.tr SMTP PasswordGkasteknik@2022 SMTP Hostmail.gkas.com.tr SMTP SendToarifguney@gkas.com.tr SMTP Port587 | |||||||||||||||
Total events
740
Read events
732
Write events
8
Delete events
0
Modification events
| (PID) Process: | (2204) inquiry 281023 0090101091.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2204) inquiry 281023 0090101091.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2204) inquiry 281023 0090101091.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2204) inquiry 281023 0090101091.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2204 | inquiry 281023 0090101091.exe | C:\Users\admin\AppData\Local\Temp\tmp712F.tmp | xml | |
MD5:27E727C6ACC14F9EA92F15CA9BB5E1A5 | SHA256:E51AC544BEDF5DC8CD8E881550D2E6362D40A81177B8F2B121FF06432CFDC28B | |||
| 2204 | inquiry 281023 0090101091.exe | C:\Users\admin\AppData\Roaming\fdJXmpnyQyt.exe | executable | |
MD5:69110E7C026F12D745C9EB14457CF51E | SHA256:31899311DEF16C86B9D15294FD9A2B765B4A574B79A28D70B0F3DD73B25D62F5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
2
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2944 | inquiry 281023 0090101091.exe | GET | 200 | 132.226.247.73:80 | http://checkip.dyndns.org/ | unknown | html | 104 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2944 | inquiry 281023 0090101091.exe | 132.226.247.73:80 | checkip.dyndns.org | ORACLE-BMC-31898 | BR | unknown |
2944 | inquiry 281023 0090101091.exe | 185.149.100.28:587 | mail.gkas.com.tr | Veridyen Bilisim Teknolojileri Sanayi ve Ticaret Limited Sirketi | TR | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
checkip.dyndns.org |
| shared |
mail.gkas.com.tr |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
324 | svchost.exe | Misc activity | AV INFO Query to checkip.dyndns. Domain |
324 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
2944 | inquiry 281023 0090101091.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
2944 | inquiry 281023 0090101091.exe | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
2944 | inquiry 281023 0090101091.exe | A Network Trojan was detected | ET MALWARE Snake Keylogger Exfil via SMTP |
2944 | inquiry 281023 0090101091.exe | Successful Credential Theft Detected | SUSPICIOUS [ANY.RUN] Base64 encoded Password Exfiltration Atempt (shifted+1) |
2944 | inquiry 281023 0090101091.exe | Successful Credential Theft Detected | SUSPICIOUS [ANY.RUN] Base64 encoded Login Exfiltration Atempt (shifted+1) |