snakekeylogger | 455375d0dce5de32575a648514646295683ed426a5a93e050d014dcff7bddf0e

General

Target

Wire_Transfer Slip.com.exe
Size

878KB
MD5

0ab094223a81010a45ebf8135e49114c
SHA1

56ebdd5cbe602872406eaee57c6ddf87f7888ba1
SHA256

455375d0dce5de32575a648514646295683ed426a5a93e050d014dcff7bddf0e
SHA512

1e1cc45a338bd947b83cc2b214163690706245985b9d9b4838a1761c398e4cbc749fb8425ffeb73bd1ed570ebb561511240ba38263c33151db3f009965addde5

Score

10^/10

snakekeylogger keylogger ransomware spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
c44MAMBxPAEZKQf

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/764-10-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/764-11-0x00000000004648CE-mapping.dmp	family_snakekeylogger
behavioral1/memory/764-13-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 checkip.dyndns.org
10 freegeoip.app
11 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082
Suspicious use of SetThreadContext 1 IoCs

Processes:

Wire_Transfer Slip.com.exe

description pid process target process

PID 1832 set thread context of 764 1832 Wire_Transfer Slip.com.exe Wire_Transfer Slip.com.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

388 schtasks.exe

flow	ioc
5	checkip.dyndns.org
10	freegeoip.app
11	freegeoip.app

description	pid	process	target process
PID 1832 set thread context of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe

pid	process
388	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Wire_Transfer Slip.com.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118	Wire_Transfer Slip.com.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181182000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	Wire_Transfer Slip.com.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 0400000001000000100000002c8f9f661d1890b147269d8e86828ca90300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180b000000010000000e000000430065007200740075006d0000001d000000010000001000000096f98b6e79a74810ce7d398a82f977781400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded309000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703090f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad2000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	Wire_Transfer Slip.com.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\6252DC40F71143A22FDE9EF7348E064251B18118\Blob = 1900000001000000100000000b6cd9778e41ad67fd6be0a6903710440f00000001000000140000001e427a3639cce4c27e94b1777964ca289a722cad09000000010000003e000000303c06082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030806082b060105050703091400000001000000140000006daa9b0987c4d0d422ed4007374d19f191ffded31d000000010000001000000096f98b6e79a74810ce7d398a82f977780b000000010000000e000000430065007200740075006d0000000300000001000000140000006252dc40f71143a22fde9ef7348e064251b181180400000001000000100000002c8f9f661d1890b147269d8e86828ca92000000001000000100300003082030c308201f4a0030201020203010020300d06092a864886f70d0101050500303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d204341301e170d3032303631313130343633395a170d3237303631313130343633395a303e310b300906035504061302504c311b3019060355040a1312556e697a65746f2053702e207a206f2e6f2e311230100603550403130943657274756d20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ceb1c12ed34f7ccd25ce183e4fc48c6f806a73c85b51f89bd2dcbb005cb1a0fc7503ee81f088ee2352e9e615338dac2d09c576f92b398089e4974b90a5a878f873437ba461b0d858cce16c667e9cf3095e556384d5a8eff3b12e3068b3c43cd8ac6e8d995a904e34dc369a8f818850b76d964209f3d795830d414bb06a6bf8fc0f7e629f67c4ed265f10260f084ff0a45728ce8fb8ed45f66eee255daa6e39bee4932fd947a072ebfaa65bafca533fe20ec69656116ef7e966a926d87f9553ed0a8588ba4f29a5428c5eb6fc852000aa680ba11a85019cc446638288b622b1eefeaa46597ecf352cd5b6da5df748331454b6ebd96fcecd88d6ab1bda963b1d590203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d01010505000382010100b88dceefe714bacfeeb044926cb4393ea2846eadb82177d2d4778287e6204181eee2f811b763d11737be1976241c041a4ceb3daa676f2dd4cdfe653170c51ba6020aba607b6d58c29a49fe63320b6be33ac0acab3bb0e8d309518c1083c634e0c52be01ab66014276c32778cbcb27298cfcdcc3fb9c8244214d657fce62643a91de58090ce0354283ef73fd3f84ded6a0a3a93139b3b142313639c3fd1872779e54c51e301ad855d1a3bb1d57310a4d3f2bc6e64f55a5690a8c70e4c740f2e713bf7c847f4696f15f2115e831e9c7c52aefd02da12a8596718dbbc70dd9bb169ed80ce8940486a0e35ca29661521942ce8602a9b854a40f36b8a24ec06162c73	Wire_Transfer Slip.com.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Wire_Transfer Slip.com.exe

pid process

764 Wire_Transfer Slip.com.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Wire_Transfer Slip.com.exe

description pid process

Token: SeDebugPrivilege 764 Wire_Transfer Slip.com.exe

pid	process
764	Wire_Transfer Slip.com.exe

description	pid	process
Token: SeDebugPrivilege	764	Wire_Transfer Slip.com.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Wire_Transfer Slip.com.exe

description	pid	process	target process
PID 1832 wrote to memory of 388	1832	Wire_Transfer Slip.com.exe	schtasks.exe
PID 1832 wrote to memory of 388	1832	Wire_Transfer Slip.com.exe	schtasks.exe
PID 1832 wrote to memory of 388	1832	Wire_Transfer Slip.com.exe	schtasks.exe
PID 1832 wrote to memory of 388	1832	Wire_Transfer Slip.com.exe	schtasks.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe
PID 1832 wrote to memory of 764	1832	Wire_Transfer Slip.com.exe	Wire_Transfer Slip.com.exe

C:\Users\Admin\AppData\Local\Temp\Wire_Transfer Slip.com.exe
"C:\Users\Admin\AppData\Local\Temp\Wire_Transfer Slip.com.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zRruCL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5985.tmp"
2⤵
- Creates scheduled task(s)
PID:388

C:\Users\Admin\AppData\Local\Temp\Wire_Transfer Slip.com.exe
"C:\Users\Admin\AppData\Local\Temp\Wire_Transfer Slip.com.exe"
2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Install Root Certificate

1

T1130

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5985.tmp
MD5
c0e56a6e38f9f0b8e18a10b718f648ae

SHA1
6dc7bef2a279e58885984b03395b7998c81fa9a3

SHA256
cab70631932db6cd50be654dc3c4529ded8e8d11d0d63dac8e16cd410e4ccbeb

SHA512
47afa4c6bac67cb2d8a156e945e12c2d2fefc6ea56e9d3d3af2ff9cdd6bfce8c4b8aca66990d80001bb1bad847b7c41e6162270705974ab5e889d929f5b8d139

Download Submit
memory/388-8-0x0000000000000000-mapping.dmp

Download
memory/764-10-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/764-11-0x00000000004648CE-mapping.dmp

Download
memory/764-12-0x0000000073980000-0x000000007406E000-memory.dmp

Filesize
6.9MB

Download
memory/764-13-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/764-15-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1832-2-0x0000000073980000-0x000000007406E000-memory.dmp

Filesize
6.9MB

Download
memory/1832-3-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1832-5-0x0000000000430000-0x0000000000433000-memory.dmp

Filesize
12KB

Download
memory/1832-6-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1832-7-0x00000000054E0000-0x0000000005578000-memory.dmp

Filesize
608KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads