snakekeylogger | f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685

General

Target
RFQ___FL.EXE
Size 772KB
Sample210702-5dwgen7tye
SHA256 f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685
MD5 11a6161eb8cb335885badc7514dba6c2
SHA1 c86543d3797d611922afa5fec100c985df0e3fce
SHA512 a727f6ae712d6e42eeb3cafa382cbaac819922a7e04d1a57d7c0e4bfed02861194105d0820bc2c7ecd10f6aa2dd7f20aaf6a449ffe5a42a2872b627c39c3734c
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1116 set thread context of 320	1116	RFQ___FL.EXE	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
320	RFQ___FL.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	RFQ___FL.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1776	1116	RFQ___FL.EXE	29
PID 1116 wrote to memory of 1776	1116	RFQ___FL.EXE	29
PID 1116 wrote to memory of 1776	1116	RFQ___FL.EXE	29
PID 1116 wrote to memory of 1776	1116	RFQ___FL.EXE	29
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31
PID 1116 wrote to memory of 320	1116	RFQ___FL.EXE	31

C:\Users\Admin\AppData\Local\Temp\RFQ___FL.EXE
"C:\Users\Admin\AppData\Local\Temp\RFQ___FL.EXE"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qDGNoJAVsTtO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCCA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1776
- C:\Users\Admin\AppData\Local\Temp\RFQ___FL.EXE
  "C:\Users\Admin\AppData\Local\Temp\RFQ___FL.EXE"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320