snakekeylogger | 2f13f6e9fee8ddc78cf064f255b4885dbf51f69b029648e21a2f24973467fc19

Analysis

max time kernel
67s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
25-07-2021 23:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23-07-2021/Swift.bat.exe
Size

881KB
MD5

aeb27feb1512dd535095f86595b6b942
SHA1

e922aea5d270b7843d300546a25793bea7b92088
SHA256

beb634a46843656d4251d26809f37ff2288cfa38d8fe5d48975cd9b546cb5d6b
SHA512

bc7d4f7b6594021a032ee65ca20fba094cf9b75ba3adf6d8ab2050e29cbe11c3864c6e45e425e2fd1e5167554d11a27680af4d193a2eb193e76bc1853b729245

Score

10^/10

snakekeylogger keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
kinghybrid@myexodus1.com
Password:
$ASmZLn8

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral18/memory/2072-127-0x000000000046459E-mapping.dmp	family_snakekeylogger
behavioral18/memory/2072-126-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 checkip.dyndns.org
15 freegeoip.app
16 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Swift.bat.exe

description pid process target process

PID 4060 set thread context of 2072 4060 Swift.bat.exe Swift.bat.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1188 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Swift.bat.exe

pid process

2072 Swift.bat.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Swift.bat.exeSwift.bat.exe

description pid process

Token: SeDebugPrivilege 4060 Swift.bat.exe
Token: SeDebugPrivilege 2072 Swift.bat.exe

flow	ioc
13	checkip.dyndns.org
15	freegeoip.app
16	freegeoip.app

description	pid	process	target process
PID 4060 set thread context of 2072	4060	Swift.bat.exe	Swift.bat.exe

pid	process
1188	schtasks.exe

pid	process
2072	Swift.bat.exe

description	pid	process
Token: SeDebugPrivilege	4060	Swift.bat.exe
Token: SeDebugPrivilege	2072	Swift.bat.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Swift.bat.exe

description	pid	process	target process
PID 4060 wrote to memory of 1188	4060	Swift.bat.exe	schtasks.exe
PID 4060 wrote to memory of 1188	4060	Swift.bat.exe	schtasks.exe
PID 4060 wrote to memory of 1188	4060	Swift.bat.exe	schtasks.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe
PID 4060 wrote to memory of 2072	4060	Swift.bat.exe	Swift.bat.exe

C:\Users\Admin\AppData\Local\Temp\23-07-2021\Swift.bat.exe
"C:\Users\Admin\AppData\Local\Temp\23-07-2021\Swift.bat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DvrWpA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5286.tmp"
2⤵
- Creates scheduled task(s)
PID:1188

C:\Users\Admin\AppData\Local\Temp\23-07-2021\Swift.bat.exe
"C:\Users\Admin\AppData\Local\Temp\23-07-2021\Swift.bat.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Swift.bat.exe.log
MD5
c3cc52ccca9ff2b6fa8d267fc350ca6b

SHA1
a68d4028333296d222e4afd75dea36fdc98d05f3

SHA256
3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

SHA512
b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5286.tmp
MD5
036e76aaae211cd9c831b92a99a65cd9

SHA1
5ba292e45203eaa2f6a6e798d70c9bfdddf1d49f

SHA256
c9d0d108f07e49793439391f7fb747a93222070ed2ae325be60f6b1839d93edc

SHA512
ff0e3e7c2ad967d4c7aa84d829d657c2780887d6490c2436802e7301faeaa64fc06fc42339c4658a9f4694abe175ed3f1b532d5a869cfb9b287bcc53fc16e1c6

Download Submit
memory/1188-124-0x0000000000000000-mapping.dmp

Download
memory/2072-134-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/2072-133-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/2072-126-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2072-127-0x000000000046459E-mapping.dmp

Download
memory/4060-119-0x0000000004B10000-0x000000000500E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-123-0x0000000004DC0000-0x0000000004E28000-memory.dmp

Filesize
416KB

Download
memory/4060-122-0x00000000009D0000-0x0000000000A37000-memory.dmp

Filesize
412KB

Download
memory/4060-121-0x0000000004470000-0x0000000004481000-memory.dmp

Filesize
68KB

Download
memory/4060-120-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/4060-114-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/4060-118-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download