snakekeylogger | f21588a5a2118f8b06488d6ee22be10c90016e672c40e20ea92572fd955edde3

General

Target

Specifications_Details_20337_FLQ.exe
Size

503KB
MD5

432dafd9a9d895a6be98225d93533bc9
SHA1

f8372831247316dad9651f0f7dc8c94adfcc26bd
SHA256

f21588a5a2118f8b06488d6ee22be10c90016e672c40e20ea92572fd955edde3
SHA512

b5f7b6610d0dd89a639815602d94c6ffd8f7a5afd807bfaef6c58589f0a44a126b90b7cb10b893899e6317abf262facc497ed66a015ca4c7f64caa44848120a3

Score

10^/10

snakekeylogger keylogger persistence spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
D#$M779Bx*!2^111

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Specifications_Details_20337_FLQ.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\notepad\\notepad.exe\""	Specifications_Details_20337_FLQ.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 freegeoip.app
14 checkip.dyndns.org
16 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Specifications_Details_20337_FLQ.exe

description pid process target process

PID 664 set thread context of 1564 664 Specifications_Details_20337_FLQ.exe Specifications_Details_20337_FLQ.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Specifications_Details_20337_FLQ.exeSpecifications_Details_20337_FLQ.exe

pid process

664 Specifications_Details_20337_FLQ.exe
664 Specifications_Details_20337_FLQ.exe
1564 Specifications_Details_20337_FLQ.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Specifications_Details_20337_FLQ.exeSpecifications_Details_20337_FLQ.exe

description pid process

Token: SeDebugPrivilege 664 Specifications_Details_20337_FLQ.exe
Token: SeDebugPrivilege 1564 Specifications_Details_20337_FLQ.exe

flow	ioc
17	freegeoip.app
14	checkip.dyndns.org
16	freegeoip.app

description	pid	process	target process
PID 664 set thread context of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe

pid	process
664	Specifications_Details_20337_FLQ.exe
664	Specifications_Details_20337_FLQ.exe
1564	Specifications_Details_20337_FLQ.exe

description	pid	process
Token: SeDebugPrivilege	664	Specifications_Details_20337_FLQ.exe
Token: SeDebugPrivilege	1564	Specifications_Details_20337_FLQ.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Specifications_Details_20337_FLQ.exe

description	pid	process	target process
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe
PID 664 wrote to memory of 1564	664	Specifications_Details_20337_FLQ.exe	Specifications_Details_20337_FLQ.exe

C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20337_FLQ.exe
"C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20337_FLQ.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664

C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20337_FLQ.exe
C:\Users\Admin\AppData\Local\Temp\Specifications_Details_20337_FLQ.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Specifications_Details_20337_FLQ.exe.log
MD5
9e7845217df4a635ec4341c3d52ed685

SHA1
d65cb39d37392975b038ce503a585adadb805da5

SHA256
d60e596ed3d5c13dc9f1660e6d870d99487e1383891437645c4562a9ecaa8c9b

SHA512
307c3b4d4f2655bdeb177e7b9c981ca27513618903f02c120caa755c9da5a8dd03ebab660b56108a680720a97c1e9596692490aede18cc4bd77b9fc3d8e68aa1

Download Submit
memory/664-118-0x0000000005050000-0x000000000554E000-memory.dmp

Filesize
5.0MB

Download
memory/664-117-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/664-119-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/664-120-0x00000000074A0000-0x00000000074F1000-memory.dmp

Filesize
324KB

Download
memory/664-125-0x00000000077C0000-0x0000000007841000-memory.dmp

Filesize
516KB

Download
memory/664-116-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/1564-126-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1564-127-0x000000000041FE5E-mapping.dmp

Download
memory/1564-132-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/1564-133-0x0000000003020000-0x0000000003021000-memory.dmp

Filesize
4KB

Download
memory/1564-135-0x0000000006850000-0x0000000006851000-memory.dmp

Filesize
4KB

Download
memory/1564-136-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing