snakekeylogger | be2ff52ed353429d954a579493e0d95571a1da3edbecd6328bf3ef76a47aeda0

General

Target

PO-09IOIOOUIR.exe
Size

23KB
MD5

b644ad55edc241dc9ee0b7bdb55c8704
SHA1

d0f4162b77fd7e63fb175c061395beaa379e233d
SHA256

be2ff52ed353429d954a579493e0d95571a1da3edbecd6328bf3ef76a47aeda0
SHA512

3ff994c5d5442f2047cf31117e47e60d3d58e6a8663b6a2cacb64982f5deb8488c037470d2087e5b73c3f8253f5b193a9e621ad51756d2dd05034a75fbe141d9

Score

10^/10

snakekeylogger keylogger persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

PO-09IOIOOUIR.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\PO-09IOIOOUIR.exe\""	PO-09IOIOOUIR.exe

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1276-10-0x0000000005BD0000-0x0000000005C70000-memory.dmp	family_snakekeylogger
behavioral2/memory/2620-11-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral2/memory/2620-12-0x00000000004643BE-mapping.dmp	family_snakekeylogger
behavioral2/memory/572-14-0x00000000004643BE-mapping.dmp	family_snakekeylogger
behavioral2/memory/2864-18-0x00000000004643BE-mapping.dmp	family_snakekeylogger
behavioral2/memory/2584-23-0x00000000004643BE-mapping.dmp	family_snakekeylogger
behavioral2/memory/2648-31-0x00000000004643BE-mapping.dmp	family_snakekeylogger

Drops startup file 2 IoCs

Processes:

PO-09IOIOOUIR.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

PO-09IOIOOUIR.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PO-09IOIOOUIR.exe"	PO-09IOIOOUIR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO-09IOIOOUIR.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\PO-09IOIOOUIR.exe"	PO-09IOIOOUIR.exe

Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 freegeoip.app
27 freegeoip.app
11 checkip.dyndns.org
22 freegeoip.app
23 freegeoip.app
24 freegeoip.app
25 freegeoip.app

flow	ioc
26	freegeoip.app
27	freegeoip.app
11	checkip.dyndns.org
22	freegeoip.app
23	freegeoip.app
24	freegeoip.app
25	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

PO-09IOIOOUIR.exe

pid	process
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe
1276	PO-09IOIOOUIR.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

PO-09IOIOOUIR.exe

description	pid	process	target process
PID 1276 set thread context of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 set thread context of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 set thread context of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 set thread context of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 set thread context of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exe

pid process

1276 PO-09IOIOOUIR.exe
2620 PO-09IOIOOUIR.exe
572 PO-09IOIOOUIR.exe
2864 PO-09IOIOOUIR.exe
2584 PO-09IOIOOUIR.exe
2648 PO-09IOIOOUIR.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

PO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exePO-09IOIOOUIR.exe

description	pid	process
Token: SeDebugPrivilege	1276	PO-09IOIOOUIR.exe
Token: SeDebugPrivilege	2620	PO-09IOIOOUIR.exe
Token: SeDebugPrivilege	572	PO-09IOIOOUIR.exe
Token: SeDebugPrivilege	2864	PO-09IOIOOUIR.exe
Token: SeDebugPrivilege	2584	PO-09IOIOOUIR.exe
Token: SeDebugPrivilege	2648	PO-09IOIOOUIR.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

PO-09IOIOOUIR.exe

description	pid	process	target process
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2620	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 572	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2864	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2584	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe
PID 1276 wrote to memory of 2648	1276	PO-09IOIOOUIR.exe	PO-09IOIOOUIR.exe

C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe
"C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe
"C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe
"C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe
"C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe
"C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe
"C:\Users\Admin\AppData\Local\Temp\PO-09IOIOOUIR.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-09IOIOOUIR.exe.log
MD5
4d710ca9c563bbb76bb29b87d5d64282

SHA1
2b1271f68a5d18e1c1bb08800a9cc9464e8a81ad

SHA256
6c7ac5cff014a13315b8813524bbd14471f1ab7aac691be94d4d4f28e4cd2de4

SHA512
873c9ee04e4f8d23f8cf90ffea89a362e8eda43c0cfc6bb47442f93e0add8794c004081350cfbd7cfaed6d101582287b26a00951d4019dfb466f21514e5d90d6

Download Submit
memory/572-14-0x00000000004643BE-mapping.dmp

Download
memory/572-48-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/572-16-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/1276-8-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/1276-28-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1276-9-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1276-10-0x0000000005BD0000-0x0000000005C70000-memory.dmp

Filesize
640KB

Download
memory/1276-3-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1276-2-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/1276-7-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/1276-6-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/1276-5-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/2584-26-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/2584-51-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/2584-23-0x00000000004643BE-mapping.dmp

Download
memory/2620-15-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/2620-49-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2620-12-0x00000000004643BE-mapping.dmp

Download
memory/2620-11-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2648-35-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-31-0x00000000004643BE-mapping.dmp

Download
memory/2648-52-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/2864-20-0x0000000073D20000-0x000000007440E000-memory.dmp

Filesize
6.9MB

Download
memory/2864-50-0x0000000005660000-0x0000000005661000-memory.dmp

Filesize
4KB

Download
memory/2864-18-0x00000000004643BE-mapping.dmp

Download
memory/2864-53-0x00000000067B0000-0x00000000067B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads