snakekeylogger | a77a3638d5c7d0c986f01af3db3f8e92b0acb6c8311c9c20bcca49658c09c975

General

Target

Uekonhzz.exe
Size

242KB
MD5

d4d8ef44275700e1b44a4c82fa18a7e7
SHA1

8773c3226a0b274aaeb281ff9bcb1acbb37817b4
SHA256

a77a3638d5c7d0c986f01af3db3f8e92b0acb6c8311c9c20bcca49658c09c975
SHA512

d4b3ed932fcdd32519fdeb2db2e9affcaecbeb035e0d7b2fcc65355f5d87eed950b8ea69d094d2f578d3775cf7cd863187ac1ddaeadb3dc661ccdc0c45ecbe76

Score

10^/10

snakekeylogger keylogger persistence stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
nobetone.xyz
Port:
587
Username:
[email protected]
Password:
@QP5Et$cNKpj

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Uekonhzz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\.notepad.exe\","	Uekonhzz.exe

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/860-65-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/860-66-0x000000000046476E-mapping.dmp	family_snakekeylogger
behavioral1/memory/860-67-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 freegeoip.app
10 checkip.dyndns.org
15 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Uekonhzz.exe

description pid process target process

PID 684 set thread context of 860 684 Uekonhzz.exe Uekonhzz.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Uekonhzz.exeUekonhzz.exe

pid process

684 Uekonhzz.exe
684 Uekonhzz.exe
860 Uekonhzz.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Uekonhzz.exeUekonhzz.exe

description pid process

Token: SeDebugPrivilege 684 Uekonhzz.exe
Token: SeDebugPrivilege 860 Uekonhzz.exe

flow	ioc
16	freegeoip.app
10	checkip.dyndns.org
15	freegeoip.app

description	pid	process	target process
PID 684 set thread context of 860	684	Uekonhzz.exe	Uekonhzz.exe

pid	process
684	Uekonhzz.exe
684	Uekonhzz.exe
860	Uekonhzz.exe

description	pid	process
Token: SeDebugPrivilege	684	Uekonhzz.exe
Token: SeDebugPrivilege	860	Uekonhzz.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Uekonhzz.exe

description	pid	process	target process
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe
PID 684 wrote to memory of 860	684	Uekonhzz.exe	Uekonhzz.exe

C:\Users\Admin\AppData\Local\Temp\Uekonhzz.exe
"C:\Users\Admin\AppData\Local\Temp\Uekonhzz.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\Uekonhzz.exe
C:\Users\Admin\AppData\Local\Temp\Uekonhzz.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-60-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/684-62-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/684-63-0x0000000000300000-0x0000000000302000-memory.dmp

Filesize
8KB

Download
memory/684-64-0x00000000006E0000-0x0000000000720000-memory.dmp

Filesize
256KB

Download
memory/860-65-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/860-66-0x000000000046476E-mapping.dmp

Download
memory/860-67-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/860-69-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads