snakekeylogger | a544b4050677d9e5ad964398954cf7d74c96b65a1126a8bb3491fbe52ff0ec10

Analysis

max time kernel
69s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
27-07-2021 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27-07-2021/27-07-2021/ETL_013265_601_0758.exe
Size

337KB
MD5

863073f13eba19c52ef95da414aa6d6e
SHA1

195ac3ae5de2823931a3a6d9f3d455d9b107cbe2
SHA256

977a7f6f9d32df5d74f58a8fefabda186f1b467a9ff25551ab2667e620c8d136
SHA512

60083a00b32fffed577944d94596e92e009ed882a10a54de83f7436a1118777582703fbdcf6677896c3e0840ce4deb9d857963df0122f112eaa783a61d2d6102

Score

10^/10

snakekeylogger keylogger persistence spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
netjul.xyz
Port:
587
Username:
shotels5@netjul.xyz
Password:
ZG-6{&tj}+P&

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Executes dropped EXE 1 IoCs

Processes:

ETL_013265_601_0758.exe

pid process

3552 ETL_013265_601_0758.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3552	ETL_013265_601_0758.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ETL_013265_601_0758.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrom = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\chrom.exe\""	ETL_013265_601_0758.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 checkip.dyndns.org
18 freegeoip.app
19 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

ETL_013265_601_0758.exe

description pid process target process

PID 3876 set thread context of 3552 3876 ETL_013265_601_0758.exe ETL_013265_601_0758.exe

flow	ioc
16	checkip.dyndns.org
18	freegeoip.app
19	freegeoip.app

description	pid	process	target process
PID 3876 set thread context of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

ETL_013265_601_0758.exeETL_013265_601_0758.exe

pid	process
3876	ETL_013265_601_0758.exe
3876	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe
3552	ETL_013265_601_0758.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ETL_013265_601_0758.exeETL_013265_601_0758.exe

description pid process

Token: SeDebugPrivilege 3876 ETL_013265_601_0758.exe
Token: SeDebugPrivilege 3552 ETL_013265_601_0758.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ETL_013265_601_0758.exe

pid process

3552 ETL_013265_601_0758.exe

description	pid	process
Token: SeDebugPrivilege	3876	ETL_013265_601_0758.exe
Token: SeDebugPrivilege	3552	ETL_013265_601_0758.exe

pid	process
3552	ETL_013265_601_0758.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ETL_013265_601_0758.exe

description	pid	process	target process
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe
PID 3876 wrote to memory of 3552	3876	ETL_013265_601_0758.exe	ETL_013265_601_0758.exe

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\ETL_013265_601_0758.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\ETL_013265_601_0758.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\ETL_013265_601_0758.exe
C:\Users\Admin\AppData\Local\Temp\ETL_013265_601_0758.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ETL_013265_601_0758.exe.log
MD5
1df508d14c5f3cf1c615edc6b38c3a75

SHA1
d983db6b2e1aa05f6578e1c67e4f3e629835bd74

SHA256
9e40f31ccf73c8bb0076b28907a9e2a371ddbb62514177bcd2741de3d731a4f9

SHA512
ebb7d7e1a73f11c904bff5a31dd8fde1f6a9daece8e5b1850813d26bd34bf823e540bb5fef3352d6af9f730e48b237619e331b0910450ecf124603f50e4f4830

Download Submit
C:\Users\Admin\AppData\Local\Temp\ETL_013265_601_0758.exe
MD5
863073f13eba19c52ef95da414aa6d6e

SHA1
195ac3ae5de2823931a3a6d9f3d455d9b107cbe2

SHA256
977a7f6f9d32df5d74f58a8fefabda186f1b467a9ff25551ab2667e620c8d136

SHA512
60083a00b32fffed577944d94596e92e009ed882a10a54de83f7436a1118777582703fbdcf6677896c3e0840ce4deb9d857963df0122f112eaa783a61d2d6102

Download Submit
C:\Users\Admin\AppData\Local\Temp\ETL_013265_601_0758.exe
MD5
863073f13eba19c52ef95da414aa6d6e

SHA1
195ac3ae5de2823931a3a6d9f3d455d9b107cbe2

SHA256
977a7f6f9d32df5d74f58a8fefabda186f1b467a9ff25551ab2667e620c8d136

SHA512
60083a00b32fffed577944d94596e92e009ed882a10a54de83f7436a1118777582703fbdcf6677896c3e0840ce4deb9d857963df0122f112eaa783a61d2d6102

Download Submit
memory/3552-128-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/3552-141-0x0000000007060000-0x0000000007061000-memory.dmp

Filesize
4KB

Download
memory/3552-139-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/3552-137-0x00000000057F0000-0x0000000005CEE000-memory.dmp

Filesize
5.0MB

Download
memory/3552-136-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/3552-129-0x000000000041C17E-mapping.dmp

Download
memory/3876-119-0x00000000052A0000-0x000000000579E000-memory.dmp

Filesize
5.0MB

Download
memory/3876-127-0x0000000007980000-0x00000000079D6000-memory.dmp

Filesize
344KB

Download
memory/3876-122-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/3876-121-0x0000000007700000-0x0000000007701000-memory.dmp

Filesize
4KB

Download
memory/3876-120-0x0000000005480000-0x00000000054BC000-memory.dmp

Filesize
240KB

Download
memory/3876-114-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/3876-118-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/3876-117-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/3876-116-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download