snakekeylogger | 1e44d0064132989ea93be83430cdf5c27d44382d8e6e67323bbcfeb9e4b6dd3f

General

Target

NEW ORDER 112888#.exe
Size

417KB
MD5

4ad8fd18d820c070182318b295daaaf2
SHA1

c02c4fabeee20853d6be0423954985d2ab728e94
SHA256

1e44d0064132989ea93be83430cdf5c27d44382d8e6e67323bbcfeb9e4b6dd3f
SHA512

5ec9f1960f11ca1bb84ac8fbfefeef0eb4a7f6b7493aaf01e59e21bd292f23569fcf9e69d5b7b4e606de174d0c90088b876fdb668679ca4825d3900063075509

Score

10^/10

snakekeylogger keylogger spyware stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
yoOsEnk5

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
yoOsEnk5

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
9 freegeoip.app
10 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

NEW ORDER 112888#.exe

description pid process target process

PID 2000 set thread context of 1552 2000 NEW ORDER 112888#.exe NEW ORDER 112888#.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1580 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

NEW ORDER 112888#.exe

pid process

1552 NEW ORDER 112888#.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEW ORDER 112888#.exe

description pid process

Token: SeDebugPrivilege 1552 NEW ORDER 112888#.exe

flow	ioc
4	checkip.dyndns.org
9	freegeoip.app
10	freegeoip.app

description	pid	process	target process
PID 2000 set thread context of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe

pid	process
1580	schtasks.exe

pid	process
1552	NEW ORDER 112888#.exe

description	pid	process
Token: SeDebugPrivilege	1552	NEW ORDER 112888#.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

NEW ORDER 112888#.exeNEW ORDER 112888#.exe

description	pid	process	target process
PID 2000 wrote to memory of 1580	2000	NEW ORDER 112888#.exe	schtasks.exe
PID 2000 wrote to memory of 1580	2000	NEW ORDER 112888#.exe	schtasks.exe
PID 2000 wrote to memory of 1580	2000	NEW ORDER 112888#.exe	schtasks.exe
PID 2000 wrote to memory of 1580	2000	NEW ORDER 112888#.exe	schtasks.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 2000 wrote to memory of 1552	2000	NEW ORDER 112888#.exe	NEW ORDER 112888#.exe
PID 1552 wrote to memory of 436	1552	NEW ORDER 112888#.exe	netsh.exe
PID 1552 wrote to memory of 436	1552	NEW ORDER 112888#.exe	netsh.exe
PID 1552 wrote to memory of 436	1552	NEW ORDER 112888#.exe	netsh.exe
PID 1552 wrote to memory of 436	1552	NEW ORDER 112888#.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\NEW ORDER 112888#.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER 112888#.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cfneSieZKeCz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF853.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1580
- C:\Users\Admin\AppData\Local\Temp\NEW ORDER 112888#.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF853.tmp

MD5
02ac7c19c0697172d397a21646439a7c

SHA1
ee23c3958497f2db9a0b67b9f1854c65a5c2f008

SHA256
0695ac90d3975b571ee7e8af3163061708593e8e0e5171aa4c98d5dabad26b37

SHA512
c4ecd007cd1546429dbc0a903a29e6bc81b944c379ff1bfbb0f66ecbd31c95b766560a5b1001aecdd2efdf03c3bb5e64b6ff6c4a43f5345f4ad15c08b272dc84

Download Submit
memory/436-73-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/436-72-0x0000000000000000-mapping.dmp

Download
memory/1552-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1552-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1552-68-0x000000000041FA5E-mapping.dmp

Download
memory/1552-71-0x0000000004920000-0x0000000004921000-memory.dmp

Filesize
4KB

Download
memory/1580-65-0x0000000000000000-mapping.dmp

Download
memory/2000-64-0x0000000000610000-0x0000000000631000-memory.dmp

Filesize
132KB

Download
memory/2000-63-0x0000000005AF0000-0x0000000005B57000-memory.dmp

Filesize
412KB

Download
memory/2000-59-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/2000-62-0x0000000000270000-0x0000000000272000-memory.dmp

Filesize
8KB

Download
memory/2000-61-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads