| File name: | Vessels details.exe |
| Full analysis: | https://app.any.run/tasks/f0481e37-5d0c-42e3-a965-7a01ff0c962b |
| Verdict: | Malicious activity |
| Analysis date: | November 09, 2023, 13:07:38 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | C6184A0858570AB06401A2D9A7ABB84C |
| SHA1: | 5DB26522798AFBC174087C44FA4A7C233B4EB9B1 |
| SHA256: | 7ED99EB3221D685130AC3695222E9025DD62E2880F3AF360140EF1D0532E80E3 |
| SSDEEP: | 6144:7ErI76O311TFj05FJO3Cu7Hjl5Qzb2+7M02wMPnz1TCnadO9IM9E1fET9eDy7f5o:ZPCu7HjohDtYz1RoGEEk9yy2 |
MALICIOUS
Bypass execution policy to execute commands
- Powershell.exe (PID: 2700)
Drops the executable file immediately after the start
- Powershell.exe (PID: 2700)
Changes powershell execution policy (Bypass)
- Vessels details.exe (PID: 2320)
Create files in the Startup directory
- Powershell.exe (PID: 2700)
Actions looks like stealing of personal data
- Vessels details.exe (PID: 976)
Steals credentials from Web Browsers
- Vessels details.exe (PID: 976)
SNAKE has been detected (YARA)
- Vessels details.exe (PID: 976)
SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- Vessels details.exe (PID: 2320)
Process creates executable files without a name
- Powershell.exe (PID: 2700)
Application launched itself
- Vessels details.exe (PID: 2320)
Reads the Internet Settings
- Vessels details.exe (PID: 976)
Checks for external IP
- Vessels details.exe (PID: 976)
Accesses Microsoft Outlook profiles
- Vessels details.exe (PID: 976)
The process verifies whether the antivirus software is installed
- Vessels details.exe (PID: 976)
Reads settings of System Certificates
- Vessels details.exe (PID: 976)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- Vessels details.exe (PID: 976)
INFO
Reads the computer name
- Vessels details.exe (PID: 2320)
- Vessels details.exe (PID: 976)
Reads the machine GUID from the registry
- Vessels details.exe (PID: 2320)
- Vessels details.exe (PID: 976)
Checks supported languages
- Vessels details.exe (PID: 2320)
- Vessels details.exe (PID: 976)
Reads Environment values
- Vessels details.exe (PID: 976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
SnakeKeylogger
(PID) Process(976) Vessels details.exe
Keys
DES6fc98cd6
Options
SMTP Userkingjacko@yandex.com
SMTP Passwordchijiokejackson121
SMTP Hostmail.yandex.com
SMTP SendTokingjacko@yandex.com
SMTP Port587
Telegram Bot Token5206100572:AAFn3MxBuN0bjQhfY8y1ed9Iwi79LyIe75I
Telegram Chat ID2135869667
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (63.1) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (23.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (5.6) |
| .exe | | | Win32 Executable (generic) (3.8) |
| .exe | | | Generic Win/DOS Executable (1.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2096:11:07 08:34:03+01:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 380928 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x5ee0e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | pet |
| FileVersion: | 1.0.0.0 |
| InternalName: | pet.exe |
| LegalCopyright: | Copyright © 2021 |
| LegalTrademarks: | - |
| OriginalFileName: | pet.exe |
| ProductName: | pet |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
35
Monitored processes
3
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 976 | "C:\Users\admin\AppData\Local\Temp\Vessels details.exe" | C:\Users\admin\AppData\Local\Temp\Vessels details.exe | Vessels details.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: pet Exit code: 0 Version: 1.0.0.0 Modules
SnakeKeylogger(PID) Process(976) Vessels details.exe Keys DES6fc98cd6 Options SMTP Userkingjacko@yandex.com SMTP Passwordchijiokejackson121 SMTP Hostmail.yandex.com SMTP SendTokingjacko@yandex.com SMTP Port587 Telegram Bot Token5206100572:AAFn3MxBuN0bjQhfY8y1ed9Iwi79LyIe75I Telegram Chat ID2135869667 | |||||||||||||||
| 2320 | "C:\Users\admin\AppData\Local\Temp\Vessels details.exe" | C:\Users\admin\AppData\Local\Temp\Vessels details.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: pet Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2700 | "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\admin\AppData\Local\Temp\Vessels details.exe' 'C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe' | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | Vessels details.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
Total events
1 662
Read events
1 657
Write events
5
Delete events
0
Modification events
| (PID) Process: | (976) Vessels details.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
1
Suspicious files
3
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2700 | Powershell.exe | C:\Users\admin\AppData\Local\Temp\r0l5edal.ltq.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 2700 | Powershell.exe | C:\Users\admin\AppData\Local\Temp\u0fwxm3u.5ad.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:— | |||
| 2700 | Powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:446DD1CF97EABA21CF14D03AEBC79F27 | SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF | |||
| 2700 | Powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe | executable | |
MD5:C6184A0858570AB06401A2D9A7ABB84C | SHA256:7ED99EB3221D685130AC3695222E9025DD62E2880F3AF360140EF1D0532E80E3 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
2
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
976 | Vessels details.exe | GET | 200 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | html | 105 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
324 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
976 | Vessels details.exe | 158.101.44.242:80 | checkip.dyndns.org | ORACLE-BMC-31898 | US | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1956 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
976 | Vessels details.exe | 149.154.167.220:443 | api.telegram.org | Telegram Messenger Inc | GB | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
checkip.dyndns.org |
| shared |
api.telegram.org |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
324 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
324 | svchost.exe | Misc activity | AV INFO Query to checkip.dyndns. Domain |
976 | Vessels details.exe | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
976 | Vessels details.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup - checkip.dyndns.org |
324 | svchost.exe | Misc activity | ET HUNTING Telegram API Domain in DNS Lookup |
976 | Vessels details.exe | Misc activity | ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI) |
976 | Vessels details.exe | Misc activity | ET HUNTING Telegram API Certificate Observed |