snakekeylogger | ed18bf204914e704fe7d77312b00b654d329666334abaf7bd3af546bad9dc4a6

General

Target
xoTrmJx7i6t8dy9.exe
Size 573KB
Sample201119-vcjntwvr8a
SHA256 ed18bf204914e704fe7d77312b00b654d329666334abaf7bd3af546bad9dc4a6
MD5 51fd98c3d315f959249a13de6f2b7960
SHA1 3f9bfd3af0ac8868b19b1337b89ede5a2afbaba3
SHA512 db3c05302eb380a4b0717c19753a73d3a056870179b8df233ff95f0ab83cb1ffa0a01c677d414d3113cc4475270fbf54dcc7e080fd2d8684313427a351bc934a
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1004-7-0x0000000008150000-0x00000000081B3000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	xoTrmJx7i6t8dy9.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1636	1004	xoTrmJx7i6t8dy9.exe	29
PID 1004 wrote to memory of 1636	1004	xoTrmJx7i6t8dy9.exe	29
PID 1004 wrote to memory of 1636	1004	xoTrmJx7i6t8dy9.exe	29
PID 1004 wrote to memory of 1636	1004	xoTrmJx7i6t8dy9.exe	29

C:\Users\Admin\AppData\Local\Temp\xoTrmJx7i6t8dy9.exe
"C:\Users\Admin\AppData\Local\Temp\xoTrmJx7i6t8dy9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yYezRekP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF892.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1636