snakekeylogger | ed18bf204914e704fe7d77312b00b654d329666334abaf7bd3af546bad9dc4a6

General

Target

xoTrmJx7i6t8dy9.exe
Size

573KB
MD5

51fd98c3d315f959249a13de6f2b7960
SHA1

3f9bfd3af0ac8868b19b1337b89ede5a2afbaba3
SHA256

ed18bf204914e704fe7d77312b00b654d329666334abaf7bd3af546bad9dc4a6
SHA512

db3c05302eb380a4b0717c19753a73d3a056870179b8df233ff95f0ab83cb1ffa0a01c677d414d3113cc4475270fbf54dcc7e080fd2d8684313427a351bc934a

Score

10^/10

snakekeylogger keylogger spyware stealer

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
orisinlog.com
Port:
21
Username:
[email protected]
Password:
fENCThl=g{Ft

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://orisinlog.com/
Port:
21
Username:
[email protected]
Password:
fENCThl=g{Ft

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4680-12-0x000000000AE60000-0x000000000AEC3000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	checkip.dyndns.org
24	freegeoip.app
25	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4680	xoTrmJx7i6t8dy9.exe
4680	xoTrmJx7i6t8dy9.exe
4680	xoTrmJx7i6t8dy9.exe
4680	xoTrmJx7i6t8dy9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	xoTrmJx7i6t8dy9.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4296	4680	xoTrmJx7i6t8dy9.exe	78
PID 4680 wrote to memory of 4296	4680	xoTrmJx7i6t8dy9.exe	78
PID 4680 wrote to memory of 4296	4680	xoTrmJx7i6t8dy9.exe	78

C:\Users\Admin\AppData\Local\Temp\xoTrmJx7i6t8dy9.exe
"C:\Users\Admin\AppData\Local\Temp\xoTrmJx7i6t8dy9.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yYezRekP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD799.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4680-4-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/4680-0-0x0000000073900000-0x0000000073FEE000-memory.dmp

Filesize
6.9MB

Download
memory/4680-5-0x00000000079A0000-0x00000000079A1000-memory.dmp

Filesize
4KB

Download
memory/4680-6-0x000000000A3A0000-0x000000000A3A1000-memory.dmp

Filesize
4KB

Download
memory/4680-7-0x0000000007CF0000-0x0000000007D04000-memory.dmp

Filesize
80KB

Download
memory/4680-8-0x0000000009780000-0x000000000980F000-memory.dmp

Filesize
572KB

Download
memory/4680-9-0x000000000A210000-0x000000000A211000-memory.dmp

Filesize
4KB

Download
memory/4680-3-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Filesize
4KB

Download
memory/4680-1-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/4680-12-0x000000000AE60000-0x000000000AEC3000-memory.dmp

Filesize
396KB

Download
memory/4680-13-0x000000000B500000-0x000000000B501000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads