snakekeylogger | daca2995c370089febb1385775ee446b2a451b363a481437bf7ab9817b3dc711

General

Target

IMG PO 012807_32X.doc
Size

76KB
MD5

9af6d69cd3b279c84b891f8ef7824731
SHA1

f872dcb0021881e884fcbbbef07cea19a0725467
SHA256

daca2995c370089febb1385775ee446b2a451b363a481437bf7ab9817b3dc711
SHA512

4a051c27a5f8a772aaa8eab25bd7740bd7368f902acb2b976a4a4d60ad0a0cea0453d5e9084998e0db930667c854d7abc579227cfe3631a861bbfde95080ceb8

Score

10^/10

snakekeylogger keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
bh-16.webhostbox.net
Port:
587
Username:
whesilolog@miratechs.gq
Password:
7213575aceACE@#$

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/552-71-0x0000000000310000-0x000000000031B000-memory.dmp	CustAttr

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

6 1868 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

whesilo582512.exewhesilo582512.exe

pid process

552 whesilo582512.exe
584 whesilo582512.exe
Loads dropped DLL 1 IoCs

Processes:

EQNEDT32.EXE

pid process

1868 EQNEDT32.EXE
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 checkip.dyndns.org
9 freegeoip.app
10 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

whesilo582512.exe

description pid process target process

PID 552 set thread context of 584 552 whesilo582512.exe whesilo582512.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1868 EQNEDT32.EXE

flow	pid	process
6	1868	EQNEDT32.EXE

pid	process
552	whesilo582512.exe
584	whesilo582512.exe

pid	process
1868	EQNEDT32.EXE

flow	ioc
7	checkip.dyndns.org
9	freegeoip.app
10	freegeoip.app

description	pid	process	target process
PID 552 set thread context of 584	552	whesilo582512.exe	whesilo582512.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	process
1868	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

292 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

whesilo582512.exe

pid process

584 whesilo582512.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

whesilo582512.exe

description pid process

Token: SeDebugPrivilege 584 whesilo582512.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

292 WINWORD.EXE
292 WINWORD.EXE

pid	process
292	WINWORD.EXE

pid	process
584	whesilo582512.exe

description	pid	process
Token: SeDebugPrivilege	584	whesilo582512.exe

pid	process
292	WINWORD.EXE
292	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEwhesilo582512.exe

description	pid	process	target process
PID 1868 wrote to memory of 552	1868	EQNEDT32.EXE	whesilo582512.exe
PID 1868 wrote to memory of 552	1868	EQNEDT32.EXE	whesilo582512.exe
PID 1868 wrote to memory of 552	1868	EQNEDT32.EXE	whesilo582512.exe
PID 1868 wrote to memory of 552	1868	EQNEDT32.EXE	whesilo582512.exe
PID 292 wrote to memory of 1760	292	WINWORD.EXE	splwow64.exe
PID 292 wrote to memory of 1760	292	WINWORD.EXE	splwow64.exe
PID 292 wrote to memory of 1760	292	WINWORD.EXE	splwow64.exe
PID 292 wrote to memory of 1760	292	WINWORD.EXE	splwow64.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe
PID 552 wrote to memory of 584	552	whesilo582512.exe	whesilo582512.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\IMG PO 012807_32X.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1760

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Roaming\whesilo582512.exe
"C:\Users\Admin\AppData\Roaming\whesilo582512.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:552

C:\Users\Admin\AppData\Roaming\whesilo582512.exe
"C:\Users\Admin\AppData\Roaming\whesilo582512.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\whesilo582512.exe
MD5
ede697a91e18c73baf01ca677aa33917

SHA1
699f96d0a34bfacd78a8530f507769d5d18dccc5

SHA256
1e2785c94e1501731c09b13b6f8156548704a36dd5b220efab73c06ed4fd6bfc

SHA512
7725d2f003a2aeecfe85dff03654b60ea80914ea39b369d6314443600750f4e13ab04a1c7a0925314e1013af034c0c4640dc3f98b9034851cff6b91c3c518bd9

Download Submit
C:\Users\Admin\AppData\Roaming\whesilo582512.exe
MD5
ede697a91e18c73baf01ca677aa33917

SHA1
699f96d0a34bfacd78a8530f507769d5d18dccc5

SHA256
1e2785c94e1501731c09b13b6f8156548704a36dd5b220efab73c06ed4fd6bfc

SHA512
7725d2f003a2aeecfe85dff03654b60ea80914ea39b369d6314443600750f4e13ab04a1c7a0925314e1013af034c0c4640dc3f98b9034851cff6b91c3c518bd9

Download Submit
C:\Users\Admin\AppData\Roaming\whesilo582512.exe
MD5
ede697a91e18c73baf01ca677aa33917

SHA1
699f96d0a34bfacd78a8530f507769d5d18dccc5

SHA256
1e2785c94e1501731c09b13b6f8156548704a36dd5b220efab73c06ed4fd6bfc

SHA512
7725d2f003a2aeecfe85dff03654b60ea80914ea39b369d6314443600750f4e13ab04a1c7a0925314e1013af034c0c4640dc3f98b9034851cff6b91c3c518bd9

Download Submit
\Users\Admin\AppData\Roaming\whesilo582512.exe
MD5
ede697a91e18c73baf01ca677aa33917

SHA1
699f96d0a34bfacd78a8530f507769d5d18dccc5

SHA256
1e2785c94e1501731c09b13b6f8156548704a36dd5b220efab73c06ed4fd6bfc

SHA512
7725d2f003a2aeecfe85dff03654b60ea80914ea39b369d6314443600750f4e13ab04a1c7a0925314e1013af034c0c4640dc3f98b9034851cff6b91c3c518bd9

Download Submit
memory/292-59-0x0000000072441000-0x0000000072444000-memory.dmp

Filesize
12KB

Download
memory/292-60-0x000000006FEC1000-0x000000006FEC3000-memory.dmp

Filesize
8KB

Download
memory/292-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/292-62-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/292-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/552-71-0x0000000000310000-0x000000000031B000-memory.dmp

Filesize
44KB

Download
memory/552-70-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/552-74-0x0000000007F60000-0x0000000007FC8000-memory.dmp

Filesize
416KB

Download
memory/552-75-0x00000000008A0000-0x00000000008C6000-memory.dmp

Filesize
152KB

Download
memory/552-68-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/552-65-0x0000000000000000-mapping.dmp

Download
memory/584-77-0x000000000041F89E-mapping.dmp

Download
memory/584-76-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/584-79-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/584-81-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/1760-72-0x0000000000000000-mapping.dmp

Download
memory/1760-73-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads