snakekeylogger | 0f2248b251c06a4670cc3708f230beb695f536d2aa9f3d6a88e627635fa54c6a

General

Target

DHL SHIPMENT DOCUMENT.exe
Size

20KB
MD5

9121604701673e2840cd3a8fb4d5672b
SHA1

428874c8045f5bef784b6139be6020b8c5e8439e
SHA256

0f2248b251c06a4670cc3708f230beb695f536d2aa9f3d6a88e627635fa54c6a
SHA512

36ce6182b5ab6607fb06f7f0654ddf3c85d8ba32f7a4c1f6417727adc3b864ee76408865447d5dd0102533971687124e63197f27f61d67878f2a3c1bd289e85b

Score

10^/10

snakekeylogger evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-18-0x0000000000464B6E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1736-17-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/1736-20-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

DHL SHIPMENT DOCUMENT.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	DHL SHIPMENT DOCUMENT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	DHL SHIPMENT DOCUMENT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files\Common Files\System\CirCIdJsuRdQNBkvdAXoiUVYsIER\svchost.exe = "0"	DHL SHIPMENT DOCUMENT.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DHL SHIPMENT DOCUMENT.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\iGfvjaqIXaqVBCzDwhIlnDPkFBGah = "explorer.exe \"C:\\Program Files\\Common Files\\System\\CirCIdJsuRdQNBkvdAXoiUVYsIER\\svchost.exe\""	DHL SHIPMENT DOCUMENT.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 freegeoip.app
14 freegeoip.app
8 checkip.dyndns.org

flow	ioc
13	freegeoip.app
14	freegeoip.app
8	checkip.dyndns.org

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

Processes:

DHL SHIPMENT DOCUMENT.exe

pid	process
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL SHIPMENT DOCUMENT.exe

description pid process target process

PID 1096 set thread context of 1736 1096 DHL SHIPMENT DOCUMENT.exe DHL SHIPMENT DOCUMENT.exe

description	pid	process	target process
PID 1096 set thread context of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe

Drops file in Program Files directory 2 IoCs

Processes:

DHL SHIPMENT DOCUMENT.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\CirCIdJsuRdQNBkvdAXoiUVYsIER\svchost.exe	DHL SHIPMENT DOCUMENT.exe
File opened for modification	C:\Program Files\Common Files\System\CirCIdJsuRdQNBkvdAXoiUVYsIER\svchost.exe	DHL SHIPMENT DOCUMENT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

388 1096 WerFault.exe DHL SHIPMENT DOCUMENT.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1020 timeout.exe

pid	pid_target	process	target process
388	1096	WerFault.exe	DHL SHIPMENT DOCUMENT.exe

pid	process
1020	timeout.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exeDHL SHIPMENT DOCUMENT.exeDHL SHIPMENT DOCUMENT.exeWerFault.exe

pid	process
840	powershell.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1096	DHL SHIPMENT DOCUMENT.exe
1736	DHL SHIPMENT DOCUMENT.exe
388	WerFault.exe
388	WerFault.exe
388	WerFault.exe
388	WerFault.exe
388	WerFault.exe
840	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

DHL SHIPMENT DOCUMENT.exepowershell.exeDHL SHIPMENT DOCUMENT.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1096	DHL SHIPMENT DOCUMENT.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1736	DHL SHIPMENT DOCUMENT.exe
Token: SeDebugPrivilege	388	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DHL SHIPMENT DOCUMENT.exe

pid process

1736 DHL SHIPMENT DOCUMENT.exe

pid	process
1736	DHL SHIPMENT DOCUMENT.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

DHL SHIPMENT DOCUMENT.execmd.exe

description	pid	process	target process
PID 1096 wrote to memory of 840	1096	DHL SHIPMENT DOCUMENT.exe	powershell.exe
PID 1096 wrote to memory of 840	1096	DHL SHIPMENT DOCUMENT.exe	powershell.exe
PID 1096 wrote to memory of 840	1096	DHL SHIPMENT DOCUMENT.exe	powershell.exe
PID 1096 wrote to memory of 840	1096	DHL SHIPMENT DOCUMENT.exe	powershell.exe
PID 1096 wrote to memory of 1460	1096	DHL SHIPMENT DOCUMENT.exe	cmd.exe
PID 1096 wrote to memory of 1460	1096	DHL SHIPMENT DOCUMENT.exe	cmd.exe
PID 1096 wrote to memory of 1460	1096	DHL SHIPMENT DOCUMENT.exe	cmd.exe
PID 1096 wrote to memory of 1460	1096	DHL SHIPMENT DOCUMENT.exe	cmd.exe
PID 1460 wrote to memory of 1020	1460	cmd.exe	timeout.exe
PID 1460 wrote to memory of 1020	1460	cmd.exe	timeout.exe
PID 1460 wrote to memory of 1020	1460	cmd.exe	timeout.exe
PID 1460 wrote to memory of 1020	1460	cmd.exe	timeout.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 1736	1096	DHL SHIPMENT DOCUMENT.exe	DHL SHIPMENT DOCUMENT.exe
PID 1096 wrote to memory of 388	1096	DHL SHIPMENT DOCUMENT.exe	WerFault.exe
PID 1096 wrote to memory of 388	1096	DHL SHIPMENT DOCUMENT.exe	WerFault.exe
PID 1096 wrote to memory of 388	1096	DHL SHIPMENT DOCUMENT.exe	WerFault.exe
PID 1096 wrote to memory of 388	1096	DHL SHIPMENT DOCUMENT.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DHL SHIPMENT DOCUMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPMENT DOCUMENT.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\CirCIdJsuRdQNBkvdAXoiUVYsIER\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 1
2⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1020

C:\Users\Admin\AppData\Local\Temp\DHL SHIPMENT DOCUMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPMENT DOCUMENT.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1328
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-22-0x0000000000000000-mapping.dmp

Download
memory/388-27-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/388-25-0x0000000001E30000-0x0000000001E41000-memory.dmp

Filesize
68KB

Download
memory/840-26-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/840-16-0x0000000002752000-0x0000000002753000-memory.dmp

Filesize
4KB

Download
memory/840-8-0x0000000000000000-mapping.dmp

Download
memory/840-60-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download
memory/840-11-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/840-12-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/840-13-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/840-24-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/840-15-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/840-30-0x0000000006050000-0x0000000006051000-memory.dmp

Filesize
4KB

Download
memory/840-59-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/840-45-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/840-44-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/840-37-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/840-36-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/840-35-0x0000000006090000-0x0000000006091000-memory.dmp

Filesize
4KB

Download
memory/1020-14-0x0000000000000000-mapping.dmp

Download
memory/1096-3-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1096-2-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/1096-7-0x0000000005590000-0x0000000005666000-memory.dmp

Filesize
856KB

Download
memory/1096-5-0x0000000075301000-0x0000000075303000-memory.dmp

Filesize
8KB

Download
memory/1096-6-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/1460-10-0x0000000000000000-mapping.dmp

Download
memory/1736-23-0x0000000000480000-0x0000000000481000-memory.dmp

Filesize
4KB

Download
memory/1736-20-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1736-19-0x0000000074580000-0x0000000074C6E000-memory.dmp

Filesize
6.9MB

Download
memory/1736-17-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1736-18-0x0000000000464B6E-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads