snakekeylogger | 745b655e27656f2b312cfbb28cbe718ea494c503cd96fa63ee65a9a3caa8f939

General

Target

RFQ_FOR_PO.exe
Size

1.7MB
MD5

3696d772035228acb5692f4ff6ad9fd7
SHA1

2a2a4e13d861dcf3b31b089ae9b99281dd3d6ef7
SHA256

745b655e27656f2b312cfbb28cbe718ea494c503cd96fa63ee65a9a3caa8f939
SHA512

802ba65ea3223aa68d17f86023e669a00884fec71f8631b3ed925a2a82967d8cb13b9dfefc13237af50949a22a0c9a0adb4980499aeb4d4418fe2b7454f43101

Score

10^/10

snakekeylogger keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/336-10-0x0000000000400000-0x0000000000466000-memory.dmp	family_snakekeylogger
behavioral1/memory/336-11-0x0000000000461EEE-mapping.dmp	family_snakekeylogger
behavioral1/memory/336-13-0x0000000000400000-0x0000000000466000-memory.dmp	family_snakekeylogger

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 freegeoip.app
5 checkip.dyndns.org
10 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ_FOR_PO.exe

description pid process target process

PID 2028 set thread context of 336 2028 RFQ_FOR_PO.exe RFQ_FOR_PO.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2008 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RFQ_FOR_PO.exe

pid process

336 RFQ_FOR_PO.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ_FOR_PO.exe

description pid process

Token: SeDebugPrivilege 336 RFQ_FOR_PO.exe

flow	ioc
11	freegeoip.app
5	checkip.dyndns.org
10	freegeoip.app

description	pid	process	target process
PID 2028 set thread context of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe

pid	process
2008	schtasks.exe

pid	process
336	RFQ_FOR_PO.exe

description	pid	process
Token: SeDebugPrivilege	336	RFQ_FOR_PO.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

RFQ_FOR_PO.exe

description	pid	process	target process
PID 2028 wrote to memory of 2008	2028	RFQ_FOR_PO.exe	schtasks.exe
PID 2028 wrote to memory of 2008	2028	RFQ_FOR_PO.exe	schtasks.exe
PID 2028 wrote to memory of 2008	2028	RFQ_FOR_PO.exe	schtasks.exe
PID 2028 wrote to memory of 2008	2028	RFQ_FOR_PO.exe	schtasks.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe
PID 2028 wrote to memory of 336	2028	RFQ_FOR_PO.exe	RFQ_FOR_PO.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_FOR_PO.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_FOR_PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EIIphOzWsDnVnb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD604.tmp"
2⤵
- Creates scheduled task(s)
PID:2008

C:\Users\Admin\AppData\Local\Temp\RFQ_FOR_PO.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_FOR_PO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD604.tmp
MD5
9afdb2b9551504b333d8ef7d352f6324

SHA1
ead8db63be4df925513482008a67ff1fe176bf85

SHA256
25b11d926066d89e8c9b23930e317a24819fbc19af195079558230ffc0b7c51a

SHA512
518d39fb1f726bf3d96ab4522b9204fd789eacdcf16b38fdcceed2e89033660b5371c81cc7dd17c799c537a35b02317e8ead1bd8b7959905f3eb6dfab1aca0fc

Download Submit
memory/336-10-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/336-11-0x0000000000461EEE-mapping.dmp

Download
memory/336-12-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/336-13-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/336-15-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/2008-8-0x0000000000000000-mapping.dmp

Download
memory/2028-2-0x0000000074EE0000-0x00000000755CE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-3-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/2028-5-0x0000000000540000-0x0000000000563000-memory.dmp

Filesize
140KB

Download
memory/2028-6-0x00000000072B0000-0x00000000072B1000-memory.dmp

Filesize
4KB

Download
memory/2028-7-0x0000000007790000-0x0000000007829000-memory.dmp

Filesize
612KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads