Edit tour

Windows Analysis Report
MT Marine Tiger.exe

Overview

General Information

Sample name:	MT Marine Tiger.exe
Analysis ID:	1455418
MD5:	730e2e475c3e7bb87ca8e53f7f31cfdf
SHA1:	dc2b601e25719862f02be67becc9e499ad97d5ab
SHA256:	faebc09f47203bbe599ac368f12622f38255e957d1435e6763c80bf2ebd988bf
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code references suspicious native API functions

AI detected suspicious sample

Machine Learning detection for sample

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MT Marine Tiger.exe (PID: 5968 cmdline: "C:\Users\user\Desktop\MT Marine Tiger.exe" MD5: 730E2E475C3E7BB87CA8E53F7F31CFDF)

MT Marine Tiger.exe (PID: 2584 cmdline: "C:\Users\user\Desktop\MT Marine Tiger.exe" MD5: 730E2E475C3E7BB87CA8E53F7F31CFDF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "rightlut@valleycountysar.org", "Password": "fY,FLoadtsiF", "Host": "valleycountysar.org", "Port": "26"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14781:$a1: get_encryptedPassword 0x14a77:$a2: get_encryptedUsername 0x1458d:$a3: get_timePasswordChanged 0x14688:$a4: get_passwordField 0x14797:$a5: set_encryptedPassword 0x15da1:$a7: get_logins 0x15d04:$a10: KeyLoggerEventArgs 0x1599d:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18128:$x1: $%SMTPDV$ 0x1818e:$x2: $#TheHashHere%& 0x197b7:$x3: %FTPDV$ 0x198ab:$x4: $%TelegramDv$ 0x1599d:$x5: KeyLoggerEventArgs 0x15d04:$x5: KeyLoggerEventArgs 0x197db:$m2: Clipboard Logs ID 0x199a7:$m2: Screenshot Logs ID 0x19a73:$m2: keystroke Logs ID 0x1997f:$m4: \SnakeKeylogger\
00000000.00000002.1255274619.0000000005480000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4aa6b:$x1: In$J$ct0r
00000002.00000002.3725046193.0000000002A08000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf2f91:$a1: get_encryptedPassword 0x1137c1:$a1: get_encryptedPassword 0x133de1:$a1: get_encryptedPassword 0xf3287:$a2: get_encryptedUsername 0x113ab7:$a2: get_encryptedUsername 0x1340d7:$a2: get_encryptedUsername 0xf2d9d:$a3: get_timePasswordChanged 0x1135cd:$a3: get_timePasswordChanged 0x133bed:$a3: get_timePasswordChanged 0xf2e98:$a4: get_passwordField 0x1136c8:$a4: get_passwordField 0x133ce8:$a4: get_passwordField 0xf2fa7:$a5: set_encryptedPassword 0x1137d7:$a5: set_encryptedPassword 0x133df7:$a5: set_encryptedPassword 0xf45b1:$a7: get_logins 0x114de1:$a7: get_logins 0x135401:$a7: get_logins 0xf4514:$a10: KeyLoggerEventArgs 0x114d44:$a10: KeyLoggerEventArgs 0x135364:$a10: KeyLoggerEventArgs
00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xf6938:$x1: $%SMTPDV$ 0x117168:$x1: $%SMTPDV$ 0x137788:$x1: $%SMTPDV$ 0xf699e:$x2: $#TheHashHere%& 0x1171ce:$x2: $#TheHashHere%& 0x1377ee:$x2: $#TheHashHere%& 0xf7fc7:$x3: %FTPDV$ 0x1187f7:$x3: %FTPDV$ 0x138e17:$x3: %FTPDV$ 0xf80bb:$x4: $%TelegramDv$ 0x1188eb:$x4: $%TelegramDv$ 0x138f0b:$x4: $%TelegramDv$ 0xf41ad:$x5: KeyLoggerEventArgs 0xf4514:$x5: KeyLoggerEventArgs 0x1149dd:$x5: KeyLoggerEventArgs 0x114d44:$x5: KeyLoggerEventArgs 0x134ffd:$x5: KeyLoggerEventArgs 0x135364:$x5: KeyLoggerEventArgs 0xf7feb:$m2: Clipboard Logs ID 0xf81b7:$m2: Screenshot Logs ID 0xf8283:$m2: keystroke Logs ID
00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MT Marine Tiger.exe PID: 5968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MT Marine Tiger.exe PID: 5968	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MT Marine Tiger.exe PID: 5968	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MT Marine Tiger.exe PID: 5968	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x53926:$a1: get_encryptedPassword 0x53b7b:$a2: get_encryptedUsername 0x53755:$a3: get_timePasswordChanged 0x53837:$a4: get_passwordField 0x5393c:$a5: set_encryptedPassword 0x55753:$a7: get_logins 0x556d4:$a10: KeyLoggerEventArgs 0x55470:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MT Marine Tiger.exe PID: 5968	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x55470:$x5: KeyLoggerEventArgs 0x556d4:$x5: KeyLoggerEventArgs 0x55eff:$x5: KeyLoggerEventArgs 0x56233:$x5: KeyLoggerEventArgs 0x5779f:$m2: Clipboard Logs ID 0x5787f:$m2: Screenshot Logs ID 0x578b3:$m2: keystroke Logs ID 0x5786b:$m4: \SnakeKeylogger\
Process Memory Space: MT Marine Tiger.exe PID: 2584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MT Marine Tiger.exe PID: 2584	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: MT Marine Tiger.exe PID: 2584	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1f429:$a1: get_encryptedPassword 0x1f715:$a2: get_encryptedUsername 0x1f23f:$a3: get_timePasswordChanged 0x1f33a:$a4: get_passwordField 0x1f43f:$a5: set_encryptedPassword 0x2185d:$a7: get_logins 0x217c0:$a10: KeyLoggerEventArgs 0x21459:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MT Marine Tiger.exe PID: 2584	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x21459:$x5: KeyLoggerEventArgs 0x217c0:$x5: KeyLoggerEventArgs 0x220ae:$x5: KeyLoggerEventArgs 0x223e2:$x5: KeyLoggerEventArgs 0x239d6:$m2: Clipboard Logs ID 0x23ab6:$m2: Screenshot Logs ID 0x23aea:$m2: keystroke Logs ID 0x23aa2:$m4: \SnakeKeylogger\
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.MT Marine Tiger.exe.5480000.5.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4aa6b:$x1: In$J$ct0r
0.2.MT Marine Tiger.exe.5480000.5.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48c6b:$x1: In$J$ct0r
0.2.MT Marine Tiger.exe.3cc7b70.2.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48c6b:$x1: In$J$ct0r
2.2.MT Marine Tiger.exe.810000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MT Marine Tiger.exe.810000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.MT Marine Tiger.exe.810000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.MT Marine Tiger.exe.810000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14981:$a1: get_encryptedPassword 0x14c77:$a2: get_encryptedUsername 0x1478d:$a3: get_timePasswordChanged 0x14888:$a4: get_passwordField 0x14997:$a5: set_encryptedPassword 0x15fa1:$a7: get_logins 0x15f04:$a10: KeyLoggerEventArgs 0x15b9d:$a11: KeyLoggerEventArgsEventHandler
2.2.MT Marine Tiger.exe.810000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c297:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4c9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8fc:$a4: \Orbitum\User Data\Default\Login Data 0x1c93b:$a5: \Kometa\User Data\Default\Login Data
2.2.MT Marine Tiger.exe.810000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552a:$s1: UnHook 0x15531:$s2: SetHook 0x15539:$s3: CallNextHook 0x15546:$s4: _hook
2.2.MT Marine Tiger.exe.810000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18328:$x1: $%SMTPDV$ 0x1838e:$x2: $#TheHashHere%& 0x199b7:$x3: %FTPDV$ 0x19aab:$x4: $%TelegramDv$ 0x15b9d:$x5: KeyLoggerEventArgs 0x15f04:$x5: KeyLoggerEventArgs 0x199db:$m2: Clipboard Logs ID 0x19ba7:$m2: Screenshot Logs ID 0x19c73:$m2: keystroke Logs ID 0x19b7f:$m4: \SnakeKeylogger\
0.2.MT Marine Tiger.exe.3d57610.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Marine Tiger.exe.3d57610.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Marine Tiger.exe.3d77e40.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Marine Tiger.exe.3d57610.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b81:$a1: get_encryptedPassword 0x12e77:$a2: get_encryptedUsername 0x1298d:$a3: get_timePasswordChanged 0x12a88:$a4: get_passwordField 0x12b97:$a5: set_encryptedPassword 0x141a1:$a7: get_logins 0x14104:$a10: KeyLoggerEventArgs 0x13d9d:$a11: KeyLoggerEventArgsEventHandler
0.2.MT Marine Tiger.exe.3d77e40.4.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Marine Tiger.exe.3d57610.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a497:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196c9:$a3: \Google\Chrome\User Data\Default\Login Data 0x19afc:$a4: \Orbitum\User Data\Default\Login Data 0x1ab3b:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Marine Tiger.exe.3d77e40.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b81:$a1: get_encryptedPassword 0x12e77:$a2: get_encryptedUsername 0x1298d:$a3: get_timePasswordChanged 0x12a88:$a4: get_passwordField 0x12b97:$a5: set_encryptedPassword 0x141a1:$a7: get_logins 0x14104:$a10: KeyLoggerEventArgs 0x13d9d:$a11: KeyLoggerEventArgsEventHandler
0.2.MT Marine Tiger.exe.3d57610.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1372a:$s1: UnHook 0x13731:$s2: SetHook 0x13739:$s3: CallNextHook 0x13746:$s4: _hook
0.2.MT Marine Tiger.exe.3d57610.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16528:$x1: $%SMTPDV$ 0x1658e:$x2: $#TheHashHere%& 0x17bb7:$x3: %FTPDV$ 0x17cab:$x4: $%TelegramDv$ 0x13d9d:$x5: KeyLoggerEventArgs 0x14104:$x5: KeyLoggerEventArgs 0x17bdb:$m2: Clipboard Logs ID 0x17da7:$m2: Screenshot Logs ID 0x17e73:$m2: keystroke Logs ID 0x17d7f:$m4: \SnakeKeylogger\
0.2.MT Marine Tiger.exe.3d77e40.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a497:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196c9:$a3: \Google\Chrome\User Data\Default\Login Data 0x19afc:$a4: \Orbitum\User Data\Default\Login Data 0x1ab3b:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Marine Tiger.exe.3d77e40.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1372a:$s1: UnHook 0x13731:$s2: SetHook 0x13739:$s3: CallNextHook 0x13746:$s4: _hook
0.2.MT Marine Tiger.exe.3d77e40.4.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16528:$x1: $%SMTPDV$ 0x1658e:$x2: $#TheHashHere%& 0x17bb7:$x3: %FTPDV$ 0x17cab:$x4: $%TelegramDv$ 0x13d9d:$x5: KeyLoggerEventArgs 0x14104:$x5: KeyLoggerEventArgs 0x17bdb:$m2: Clipboard Logs ID 0x17da7:$m2: Screenshot Logs ID 0x17e73:$m2: keystroke Logs ID 0x17d7f:$m4: \SnakeKeylogger\
0.2.MT Marine Tiger.exe.2cca430.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa20dc:$x1: In$J$ct0r 0xa30a0:$a1: WriteProcessMemory 0xa312c:$a1: WriteProcessMemory 0xa3200:$a4: VirtualAllocEx 0xa3424:$a4: VirtualAllocEx 0xa34a4:$a4: VirtualAllocEx
0.2.MT Marine Tiger.exe.2cc7bf0.0.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xa491c:$x1: In$J$ct0r 0xa58e0:$a1: WriteProcessMemory 0xa596c:$a1: WriteProcessMemory 0xa5a40:$a4: VirtualAllocEx 0xa5c64:$a4: VirtualAllocEx 0xa5ce4:$a4: VirtualAllocEx
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14981:$a1: get_encryptedPassword 0x34fa1:$a1: get_encryptedPassword 0x14c77:$a2: get_encryptedUsername 0x35297:$a2: get_encryptedUsername 0x1478d:$a3: get_timePasswordChanged 0x34dad:$a3: get_timePasswordChanged 0x14888:$a4: get_passwordField 0x34ea8:$a4: get_passwordField 0x14997:$a5: set_encryptedPassword 0x34fb7:$a5: set_encryptedPassword 0x15fa1:$a7: get_logins 0x365c1:$a7: get_logins 0x15f04:$a10: KeyLoggerEventArgs 0x36524:$a10: KeyLoggerEventArgs 0x15b9d:$a11: KeyLoggerEventArgsEventHandler 0x361bd:$a11: KeyLoggerEventArgsEventHandler
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c297:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3c8b7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4c9:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bae9:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8fc:$a4: \Orbitum\User Data\Default\Login Data 0x3bf1c:$a4: \Orbitum\User Data\Default\Login Data 0x1c93b:$a5: \Kometa\User Data\Default\Login Data 0x3cf5b:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552a:$s1: UnHook 0x35b4a:$s1: UnHook 0x15531:$s2: SetHook 0x35b51:$s2: SetHook 0x15539:$s3: CallNextHook 0x35b59:$s3: CallNextHook 0x15546:$s4: _hook 0x35b66:$s4: _hook
0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18328:$x1: $%SMTPDV$ 0x38948:$x1: $%SMTPDV$ 0x1838e:$x2: $#TheHashHere%& 0x389ae:$x2: $#TheHashHere%& 0x199b7:$x3: %FTPDV$ 0x39fd7:$x3: %FTPDV$ 0x19aab:$x4: $%TelegramDv$ 0x3a0cb:$x4: $%TelegramDv$ 0x15b9d:$x5: KeyLoggerEventArgs 0x15f04:$x5: KeyLoggerEventArgs 0x361bd:$x5: KeyLoggerEventArgs 0x36524:$x5: KeyLoggerEventArgs 0x199db:$m2: Clipboard Logs ID 0x19ba7:$m2: Screenshot Logs ID 0x19c73:$m2: keystroke Logs ID 0x39ffb:$m2: Clipboard Logs ID 0x3a1c7:$m2: Screenshot Logs ID 0x3a293:$m2: keystroke Logs ID 0x19b7f:$m4: \SnakeKeylogger\ 0x3a19f:$m4: \SnakeKeylogger\
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14981:$a1: get_encryptedPassword 0x351b1:$a1: get_encryptedPassword 0x557d1:$a1: get_encryptedPassword 0x14c77:$a2: get_encryptedUsername 0x354a7:$a2: get_encryptedUsername 0x55ac7:$a2: get_encryptedUsername 0x1478d:$a3: get_timePasswordChanged 0x34fbd:$a3: get_timePasswordChanged 0x555dd:$a3: get_timePasswordChanged 0x14888:$a4: get_passwordField 0x350b8:$a4: get_passwordField 0x556d8:$a4: get_passwordField 0x14997:$a5: set_encryptedPassword 0x351c7:$a5: set_encryptedPassword 0x557e7:$a5: set_encryptedPassword 0x15fa1:$a7: get_logins 0x367d1:$a7: get_logins 0x56df1:$a7: get_logins 0x15f04:$a10: KeyLoggerEventArgs 0x36734:$a10: KeyLoggerEventArgs 0x56d54:$a10: KeyLoggerEventArgs
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c297:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cac7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d0e7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4c9:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bcf9:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c319:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b8fc:$a4: \Orbitum\User Data\Default\Login Data 0x3c12c:$a4: \Orbitum\User Data\Default\Login Data 0x5c74c:$a4: \Orbitum\User Data\Default\Login Data 0x1c93b:$a5: \Kometa\User Data\Default\Login Data 0x3d16b:$a5: \Kometa\User Data\Default\Login Data 0x5d78b:$a5: \Kometa\User Data\Default\Login Data
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552a:$s1: UnHook 0x35d5a:$s1: UnHook 0x5637a:$s1: UnHook 0x15531:$s2: SetHook 0x35d61:$s2: SetHook 0x56381:$s2: SetHook 0x15539:$s3: CallNextHook 0x35d69:$s3: CallNextHook 0x56389:$s3: CallNextHook 0x15546:$s4: _hook 0x35d76:$s4: _hook 0x56396:$s4: _hook
0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18328:$x1: $%SMTPDV$ 0x38b58:$x1: $%SMTPDV$ 0x59178:$x1: $%SMTPDV$ 0x1838e:$x2: $#TheHashHere%& 0x38bbe:$x2: $#TheHashHere%& 0x591de:$x2: $#TheHashHere%& 0x199b7:$x3: %FTPDV$ 0x3a1e7:$x3: %FTPDV$ 0x5a807:$x3: %FTPDV$ 0x19aab:$x4: $%TelegramDv$ 0x3a2db:$x4: $%TelegramDv$ 0x5a8fb:$x4: $%TelegramDv$ 0x15b9d:$x5: KeyLoggerEventArgs 0x15f04:$x5: KeyLoggerEventArgs 0x363cd:$x5: KeyLoggerEventArgs 0x36734:$x5: KeyLoggerEventArgs 0x569ed:$x5: KeyLoggerEventArgs 0x56d54:$x5: KeyLoggerEventArgs 0x199db:$m2: Clipboard Logs ID 0x19ba7:$m2: Screenshot Logs ID 0x19c73:$m2: keystroke Logs ID
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa4421:$a1: get_encryptedPassword 0xc4c51:$a1: get_encryptedPassword 0xe5271:$a1: get_encryptedPassword 0xa4717:$a2: get_encryptedUsername 0xc4f47:$a2: get_encryptedUsername 0xe5567:$a2: get_encryptedUsername 0xa422d:$a3: get_timePasswordChanged 0xc4a5d:$a3: get_timePasswordChanged 0xe507d:$a3: get_timePasswordChanged 0xa4328:$a4: get_passwordField 0xc4b58:$a4: get_passwordField 0xe5178:$a4: get_passwordField 0xa4437:$a5: set_encryptedPassword 0xc4c67:$a5: set_encryptedPassword 0xe5287:$a5: set_encryptedPassword 0xa5a41:$a7: get_logins 0xc6271:$a7: get_logins 0xe6891:$a7: get_logins 0xa59a4:$a10: KeyLoggerEventArgs 0xc61d4:$a10: KeyLoggerEventArgs 0xe67f4:$a10: KeyLoggerEventArgs
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xa4fca:$s1: UnHook 0xc57fa:$s1: UnHook 0xe5e1a:$s1: UnHook 0xa4fd1:$s2: SetHook 0xc5801:$s2: SetHook 0xe5e21:$s2: SetHook 0xa4fd9:$s3: CallNextHook 0xc5809:$s3: CallNextHook 0xe5e29:$s3: CallNextHook 0xa4fe6:$s4: _hook 0xc5816:$s4: _hook 0xe5e36:$s4: _hook
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xa7dc8:$x1: $%SMTPDV$ 0xc85f8:$x1: $%SMTPDV$ 0xe8c18:$x1: $%SMTPDV$ 0xa7e2e:$x2: $#TheHashHere%& 0xc865e:$x2: $#TheHashHere%& 0xe8c7e:$x2: $#TheHashHere%& 0xa9457:$x3: %FTPDV$ 0xc9c87:$x3: %FTPDV$ 0xea2a7:$x3: %FTPDV$ 0xa954b:$x4: $%TelegramDv$ 0xc9d7b:$x4: $%TelegramDv$ 0xea39b:$x4: $%TelegramDv$ 0xa563d:$x5: KeyLoggerEventArgs 0xa59a4:$x5: KeyLoggerEventArgs 0xc5e6d:$x5: KeyLoggerEventArgs 0xc61d4:$x5: KeyLoggerEventArgs 0xe648d:$x5: KeyLoggerEventArgs 0xe67f4:$x5: KeyLoggerEventArgs 0xa947b:$m2: Clipboard Logs ID 0xa9647:$m2: Screenshot Logs ID 0xa9713:$m2: keystroke Logs ID
0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4aa6b:$x1: In$J$ct0r
Click to see the 40 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MT Marine Tiger.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "rightlut@valleycountysar.org", "Password": "fY,FLoadtsiF", "Host": "valleycountysar.org", "Port": "26"}

Multi AV Scanner detection for submitted file

Source: MT Marine Tiger.exe

ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MT Marine Tiger.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: MT Marine Tiger.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: MT Marine Tiger.exe, 00000000.00000002.1255521425.0000000005620000.00000004.08000000.00040000.00000000.sdmp, MT Marine Tiger.exe, 00000000.00000002.1254296165.0000000002C71000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 00CCF0B5h	2_2_00CCEEC8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 00CCFA3Fh	2_2_00CCEEC8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_00CCE3E8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E48945h	2_2_04E48608
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E47751h	2_2_04E474A8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E40741h	2_2_04E40498
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E40FF1h	2_2_04E40D48
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E48001h	2_2_04E47D58
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E46171h	2_2_04E45EC8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E458C1h	2_2_04E45618
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E46A21h	2_2_04E46778
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E40B99h	2_2_04E408F0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E402E9h	2_2_04E40040
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E472FAh	2_2_04E47050
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E48459h	2_2_04E481B0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E45441h	2_2_04E45198
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E47BA9h	2_2_04E47900
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E45D19h	2_2_04E45A70
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E46E79h	2_2_04E46BD0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_04E433A8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_04E433B8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 4x nop then jmp 04E465C9h	2_2_04E46320

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.7:49704 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.91 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: MT Marine Tiger.exe, 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.85
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029B6000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002908000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029D1000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029B6000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002908000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000028F5000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002946000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MT Marine Tiger.exe, 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029B6000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002920000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029B6000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002908000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002946000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: MT Marine Tiger.exe, 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.91
Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029F2000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.00000000029B6000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002946000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.91$

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.MT Marine Tiger.exe.5480000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.5480000.5.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.2cca430.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.2cc7bf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1255274619.0000000005480000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 0_2_012DF6D0	0_2_012DF6D0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 0_2_012DD3DC	0_2_012DD3DC
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 0_2_012DF6C0	0_2_012DF6C0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCC1F0	2_2_00CCC1F0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CC6168	2_2_00CC6168
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCB388	2_2_00CCB388
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCC4D0	2_2_00CCC4D0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CC6790	2_2_00CC6790
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCC7B1	2_2_00CCC7B1
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CC98B8	2_2_00CC98B8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CC4B31	2_2_00CC4B31
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCBC32	2_2_00CCBC32
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCCDB1	2_2_00CCCDB1
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCEEC8	2_2_00CCEEC8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCE3D9	2_2_00CCE3D9
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCE3E8	2_2_00CCE3E8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CC35C8	2_2_00CC35C8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_00CCB552	2_2_00CCB552
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4A408	2_2_04E4A408
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4BD38	2_2_04E4BD38
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4B6E8	2_2_04E4B6E8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4D670	2_2_04E4D670
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E48608	2_2_04E48608
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4B0A0	2_2_04E4B0A0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4D028	2_2_04E4D028
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4C9D8	2_2_04E4C9D8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E411A0	2_2_04E411A0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4AA58	2_2_04E4AA58
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4C388	2_2_04E4C388
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E48B58	2_2_04E48B58
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E474A8	2_2_04E474A8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E40488	2_2_04E40488
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E47497	2_2_04E47497
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E40498	2_2_04E40498
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E44430	2_2_04E44430
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E485F8	2_2_04E485F8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E40D48	2_2_04E40D48
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E47D48	2_2_04E47D48
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E47D58	2_2_04E47D58
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4BD30	2_2_04E4BD30
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E40D39	2_2_04E40D39
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45EC8	2_2_04E45EC8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4B6D9	2_2_04E4B6D9
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45EB8	2_2_04E45EB8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4D668	2_2_04E4D668
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45609	2_2_04E45609
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45618	2_2_04E45618
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4676B	2_2_04E4676B
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E46778	2_2_04E46778
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E43730	2_2_04E43730
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E408E0	2_2_04E408E0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E408F0	2_2_04E408F0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E478F0	2_2_04E478F0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E40040	2_2_04E40040
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E47040	2_2_04E47040
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E47050	2_2_04E47050
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E42807	2_2_04E42807
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E40013	2_2_04E40013
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E42818	2_2_04E42818
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4D018	2_2_04E4D018
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4C9C8	2_2_04E4C9C8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E481A0	2_2_04E481A0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E481B0	2_2_04E481B0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45198	2_2_04E45198
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E47900	2_2_04E47900
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45A60	2_2_04E45A60
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E45A70	2_2_04E45A70
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4AA48	2_2_04E4AA48
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4A3F8	2_2_04E4A3F8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E46BC1	2_2_04E46BC1
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E46BD0	2_2_04E46BD0
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E433A8	2_2_04E433A8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E433B8	2_2_04E433B8
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E4C378	2_2_04E4C378
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E46320	2_2_04E46320
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Code function: 2_2_04E46311	2_2_04E46311

Source: MT Marine Tiger.exe, 00000000.00000000.1246433837.0000000000912000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAjlep.exe. vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1255521425.0000000005620000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1253206246.0000000000E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1255274619.0000000005480000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254296165.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254296165.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254296165.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMsftEdit.DLL.MUIj% vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254296165.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000000.00000002.1254296165.0000000002C71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\080904B0\\OriginalFilename vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe, 00000002.00000002.3710187557.00000000005D7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs MT Marine Tiger.exe
Source: MT Marine Tiger.exe	Binary or memory string: OriginalFilenameAjlep.exe. vs MT Marine Tiger.exe

Source: 0.2.MT Marine Tiger.exe.5480000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.MT Marine Tiger.exe.5480000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Marine Tiger.exe.2cca430.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.MT Marine Tiger.exe.2cc7bf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1255274619.0000000005480000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.5480000.5.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, -B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.MT Marine Tiger.exe.5480000.5.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MT Marine Tiger.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Mutant created: NULL

Source: MT Marine Tiger.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MT Marine Tiger.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002A98000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3726309278.00000000038CF000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002ACD000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002A7A000.00000004.00000800.00020000.00000000.sdmp, MT Marine Tiger.exe, 00000002.00000002.3725046193.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MT Marine Tiger.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\MT Marine Tiger.exe "C:\Users\user\Desktop\MT Marine Tiger.exe"
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process created: C:\Users\user\Desktop\MT Marine Tiger.exe "C:\Users\user\Desktop\MT Marine Tiger.exe"
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process created: C:\Users\user\Desktop\MT Marine Tiger.exe "C:\Users\user\Desktop\MT Marine Tiger.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

File opened: C:\Windows\SysWOW64\MsftEdit.DLL

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MT Marine Tiger.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MT Marine Tiger.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Source: MT Marine Tiger.exe

Static PE information: 0xD3BA803B [Sat Jul 25 14:24:59 2082 UTC]

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Code function: 0_2_05EFC41D push FFFFFF8Bh; iretd

0_2_05EFC41F

Source: MT Marine Tiger.exe

Static PE information: section name: .text entropy: 7.519921721445499

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Memory allocated: 12C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Memory allocated: 2C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Memory allocated: 4C70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598817	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597113	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Window / User API: threadDelayed 1309			Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Window / User API: threadDelayed 8510			Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 6160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7568	Thread sleep count: 1309 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7568	Thread sleep count: 8510 > 30	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598817s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -597113s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe TID: 7564	Thread sleep time: -593985s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598817	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 597113	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Thread delayed: delay time: 593985	Jump to behavior

Source: MT Marine Tiger.exe, 00000002.00000002.3711612625.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll a

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.MT Marine Tiger.exe.2cc7bf0.0.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.MT Marine Tiger.exe.2cc7bf0.0.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.MT Marine Tiger.exe.2cc7bf0.0.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Process created: C:\Users\user\Desktop\MT Marine Tiger.exe "C:\Users\user\Desktop\MT Marine Tiger.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Users\user\Desktop\MT Marine Tiger.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Users\user\Desktop\MT Marine Tiger.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MT Marine Tiger.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3725046193.0000000002A08000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\MT Marine Tiger.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\MT Marine Tiger.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 2.2.MT Marine Tiger.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d77e40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3d57610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MT Marine Tiger.exe.3cc7b70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3710301121.0000000000812000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3725046193.0000000002A08000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1254671742.0000000003C79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3725046193.0000000002841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MT Marine Tiger.exe PID: 5968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MT Marine Tiger.exe PID: 2584, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MT Marine Tiger.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
MT Marine Tiger.exe