snakekeylogger | ed18bf204914e704fe7d77312b00b654d329666334abaf7bd3af546bad9dc4a6

General

Target

xoTrmJx7i6t8dy9.exe
Size

573KB
MD5

51fd98c3d315f959249a13de6f2b7960
SHA1

3f9bfd3af0ac8868b19b1337b89ede5a2afbaba3
SHA256

ed18bf204914e704fe7d77312b00b654d329666334abaf7bd3af546bad9dc4a6
SHA512

db3c05302eb380a4b0717c19753a73d3a056870179b8df233ff95f0ab83cb1ffa0a01c677d414d3113cc4475270fbf54dcc7e080fd2d8684313427a351bc934a

Score

10^/10

snakekeylogger keylogger spyware stealer

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
orisinlog.com
Port:
21
Username:
[email protected]
Password:
fENCThl=g{Ft

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://orisinlog.com/
Port:
21
Username:
[email protected]
Password:
fENCThl=g{Ft

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4680-12-0x000000000AE60000-0x000000000AEC3000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 checkip.dyndns.org
24 freegeoip.app
25 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4296 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

xoTrmJx7i6t8dy9.exe

pid process

4680 xoTrmJx7i6t8dy9.exe
4680 xoTrmJx7i6t8dy9.exe
4680 xoTrmJx7i6t8dy9.exe
4680 xoTrmJx7i6t8dy9.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

xoTrmJx7i6t8dy9.exe

description pid process

Token: SeDebugPrivilege 4680 xoTrmJx7i6t8dy9.exe

flow	ioc
21	checkip.dyndns.org
24	freegeoip.app
25	freegeoip.app

pid	process
4296	schtasks.exe

pid	process
4680	xoTrmJx7i6t8dy9.exe
4680	xoTrmJx7i6t8dy9.exe
4680	xoTrmJx7i6t8dy9.exe
4680	xoTrmJx7i6t8dy9.exe

description	pid	process
Token: SeDebugPrivilege	4680	xoTrmJx7i6t8dy9.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

xoTrmJx7i6t8dy9.exe

description	pid	process	target process
PID 4680 wrote to memory of 4296	4680	xoTrmJx7i6t8dy9.exe	schtasks.exe
PID 4680 wrote to memory of 4296	4680	xoTrmJx7i6t8dy9.exe	schtasks.exe
PID 4680 wrote to memory of 4296	4680	xoTrmJx7i6t8dy9.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\xoTrmJx7i6t8dy9.exe
"C:\Users\Admin\AppData\Local\Temp\xoTrmJx7i6t8dy9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yYezRekP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD799.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD799.tmp

MD5
246160f530c5831a23561b48e34d5518

SHA1
51ea4e18c6b29429214bd3412da0f02896f0933a

SHA256
895125da0a9219dbe6bc8ab9926318d80165df03e7dcf8a3bc191ebea8418665

SHA512
2026e677142c2719e363db66dd45ecc3e6ccfcef198ff20ae1bf193838b255f05165e0963da59f6997651e9f195621ab9a50ffece81480214ad4b21a89fbbccd

Download Submit
memory/4296-10-0x0000000000000000-mapping.dmp

Download
memory/4680-4-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/4680-0-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download
memory/4680-5-0x00000000079A0000-0x00000000079A1000-memory.dmp

Filesize
4KB

Download
memory/4680-6-0x000000000A3A0000-0x000000000A3A1000-memory.dmp

Filesize
4KB

Download
memory/4680-7-0x0000000007CF0000-0x0000000007D04000-memory.dmp

Filesize
80KB

Download
memory/4680-8-0x0000000009780000-0x000000000980F000-memory.dmp

Filesize
572KB

Download
memory/4680-9-0x000000000A210000-0x000000000A211000-memory.dmp

Filesize
4KB

Download
memory/4680-3-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Filesize
4KB

Download
memory/4680-1-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/4680-12-0x000000000AE60000-0x000000000AEC3000-memory.dmp

Filesize
396KB

Download
memory/4680-13-0x000000000B500000-0x000000000B501000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads