Edit tour

Windows Analysis Report
5qJ6QQTcRS.exe

Overview

General Information

Sample name:	5qJ6QQTcRS.exe renamed because original name is a hash value
Original sample name:	e5691b515fc141f456826af6833f83e2c2f950bc8d283dac38b676abe845924c.exe
Analysis ID:	1588845
MD5:	78668d52e5b092184a4b8e6788713b3c
SHA1:	302e6b4b4f6441acbbfe4e55c6f6d8a83d94f7eb
SHA256:	e5691b515fc141f456826af6833f83e2c2f950bc8d283dac38b676abe845924c
Tags:	exeuser-adrian__luca
Infos:

Detection

DarkTortilla, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to launch a process as a different user

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5qJ6QQTcRS.exe (PID: 8140 cmdline: "C:\Users\user\Desktop\5qJ6QQTcRS.exe" MD5: 78668D52E5B092184A4B8E6788713B3C)

InstallUtil.exe (PID: 8132 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "sammys@gtpv.online", "Password": "7213575aceACE@@", "Host": "mail.gtpv.online", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "sammys@gtpv.online", "Password": "7213575aceACE@@", "Host": "mail.gtpv.online", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1971799166.0000000005B60000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000004.00000002.2542240293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2542240293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.2542240293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2542240293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2daa0:$a1: get_encryptedPassword 0x2e028:$a2: get_encryptedUsername 0x2d713:$a3: get_timePasswordChanged 0x2d82a:$a4: get_passwordField 0x2dab6:$a5: set_encryptedPassword 0x307d2:$a6: get_passwords 0x30b66:$a7: get_logins 0x307be:$a8: GetOutlookPasswords 0x30177:$a9: StartKeylogger 0x30abf:$a10: KeyLoggerEventArgs 0x30217:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1970037242.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1970037242.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1970037242.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1970037242.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dff0:$a1: get_encryptedPassword 0x2e578:$a2: get_encryptedUsername 0x2dc63:$a3: get_timePasswordChanged 0x2dd7a:$a4: get_passwordField 0x2e006:$a5: set_encryptedPassword 0x30d22:$a6: get_passwords 0x310b6:$a7: get_logins 0x30d0e:$a8: GetOutlookPasswords 0x306c7:$a9: StartKeylogger 0x3100f:$a10: KeyLoggerEventArgs 0x30767:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.2545353858.0000000002B56000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2545353858.0000000002A51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1970037242.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000000.00000002.1970037242.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1970037242.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1970037242.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1970037242.0000000003A2F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e370:$a1: get_encryptedPassword 0x2e8f8:$a2: get_encryptedUsername 0x2dfe3:$a3: get_timePasswordChanged 0x2e0fa:$a4: get_passwordField 0x2e386:$a5: set_encryptedPassword 0x310a2:$a6: get_passwords 0x31436:$a7: get_logins 0x3108e:$a8: GetOutlookPasswords 0x30a47:$a9: StartKeylogger 0x3138f:$a10: KeyLoggerEventArgs 0x30ae7:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1965003803.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: 5qJ6QQTcRS.exe PID: 8140	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: 5qJ6QQTcRS.exe PID: 8140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5qJ6QQTcRS.exe PID: 8140	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 5qJ6QQTcRS.exe PID: 8140	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 5qJ6QQTcRS.exe PID: 8140	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 5qJ6QQTcRS.exe PID: 8140	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x27588:$a1: get_encryptedPassword 0x62503:$a1: get_encryptedPassword 0x27b06:$a2: get_encryptedUsername 0x62a81:$a2: get_encryptedUsername 0x2720a:$a3: get_timePasswordChanged 0x62185:$a3: get_timePasswordChanged 0x27321:$a4: get_passwordField 0x6229c:$a4: get_passwordField 0x2759e:$a5: set_encryptedPassword 0x62519:$a5: set_encryptedPassword 0x2a262:$a6: get_passwords 0x651dd:$a6: get_passwords 0x2a5f2:$a7: get_logins 0x6556d:$a7: get_logins 0x2a24e:$a8: GetOutlookPasswords 0x651c9:$a8: GetOutlookPasswords 0x29c07:$a9: StartKeylogger 0x64b82:$a9: StartKeylogger 0x2a54b:$a10: KeyLoggerEventArgs 0x654c6:$a10: KeyLoggerEventArgs 0x29ca7:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 8132	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 8132	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 8132	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 8132	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1695a7:$a1: get_encryptedPassword 0x169b25:$a2: get_encryptedUsername 0x169229:$a3: get_timePasswordChanged 0x169340:$a4: get_passwordField 0x1695bd:$a5: set_encryptedPassword 0x16c281:$a6: get_passwords 0x16c611:$a7: get_logins 0x16c26d:$a8: GetOutlookPasswords 0x16bc26:$a9: StartKeylogger 0x16c56a:$a10: KeyLoggerEventArgs 0x16bcc6:$a11: KeyLoggerEventArgsEventHandler
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.5qJ6QQTcRS.exe.3b01960.0.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.5qJ6QQTcRS.exe.3ab6d70.2.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.5qJ6QQTcRS.exe.5b60000.3.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.5qJ6QQTcRS.exe.5b60000.3.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.5qJ6QQTcRS.exe.3b01960.0.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.5qJ6QQTcRS.exe.3ab6d70.2.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
4.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
4.2.InstallUtil.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b29e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a941:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab9e:$a4: \Orbitum\User Data\Default\Login Data 0x3b57d:$a5: \Kometa\User Data\Default\Login Data
4.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3949e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b41:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d9e:$a4: \Orbitum\User Data\Default\Login Data 0x3977d:$a5: \Kometa\User Data\Default\Login Data
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
0.2.5qJ6QQTcRS.exe.3a2f6d0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
Click to see the 21 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:14:35.817329+0100	2803305	3	Unknown Traffic	192.168.2.10	49982	104.21.112.1	443	TCP
2025-01-11T06:14:38.214770+0100	2803305	3	Unknown Traffic	192.168.2.10	49986	104.21.112.1	443	TCP
2025-01-11T06:14:40.599478+0100	2803305	3	Unknown Traffic	192.168.2.10	49990	104.21.112.1	443	TCP
2025-01-11T06:14:41.832235+0100	2803305	3	Unknown Traffic	192.168.2.10	49992	104.21.112.1	443	TCP
2025-01-11T06:14:44.289038+0100	2803305	3	Unknown Traffic	192.168.2.10	49996	104.21.112.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:14:34.400712+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49980	158.101.44.242	80	TCP
2025-01-11T06:14:35.291474+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49980	158.101.44.242	80	TCP
2025-01-11T06:14:36.463329+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49983	158.101.44.242	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:14:45.212528+0100	1810007	1	Potentially Bad Traffic	192.168.2.10	49997	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
5qJ6QQTcRS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5qJ6QQTcRS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Windows Analysis Report
5qJ6QQTcRS.exe