snakekeylogger | 7fb33351d6ef6a9ae6f3c953b3c45743281217ed32c7fe8ef8d9f06161589e7d

Analysis

max time kernel
101s
max time network
167s
platform
windows7_x64
resource
win7v20210408
submitted
28-07-2021 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TRACKING NUMBER.doc
Size

63KB
MD5

85f32390c19a033a1d2569863469a615
SHA1

81689cd34e0ad021432bd0db43f5313cf0189705
SHA256

7fb33351d6ef6a9ae6f3c953b3c45743281217ed32c7fe8ef8d9f06161589e7d
SHA512

34ae29f2bcce0f213e76f92e298ad875180a5683ada3dd45d6ad2078a060e74a6ab3573be1268ef1d10e90c7d8d0614f226c77bc5f60f42aa7f2d8a5d24556e7

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
bh-16.webhostbox.net
Port:
587
Username:
whesilolog@miratechs.gq
Password:
7213575aceACE@#$

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1672-72-0x00000000003C0000-0x00000000003CB000-memory.dmp	CustAttr

Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

7 776 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

whesilo743.exewhesilo743.exe

pid process

1672 whesilo743.exe
1696 whesilo743.exe
Loads dropped DLL 6 IoCs

Processes:

EQNEDT32.EXEWerFault.exe

pid process

776 EQNEDT32.EXE
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

whesilo743.exe

description pid process target process

PID 1672 set thread context of 1696 1672 whesilo743.exe whesilo743.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

776 1696 WerFault.exe whesilo743.exe
Office loads VBA resources, possible macro or embedded object present
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

776 EQNEDT32.EXE

flow	pid	process
7	776	EQNEDT32.EXE

pid	process
1672	whesilo743.exe
1696	whesilo743.exe

pid	process
776	EQNEDT32.EXE
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe

flow	ioc
8	checkip.dyndns.org

description	pid	process	target process
PID 1672 set thread context of 1696	1672	whesilo743.exe	whesilo743.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	pid_target	process	target process
776	1696	WerFault.exe	whesilo743.exe

pid	process
776	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1956 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

whesilo743.exeWerFault.exe

pid process

1696 whesilo743.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
776 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

whesilo743.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1696 whesilo743.exe
Token: SeDebugPrivilege 776 WerFault.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1956 WINWORD.EXE
1956 WINWORD.EXE

pid	process
1956	WINWORD.EXE

pid	process
1696	whesilo743.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe
776	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1696	whesilo743.exe
Token: SeDebugPrivilege	776	WerFault.exe

pid	process
1956	WINWORD.EXE
1956	WINWORD.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

EQNEDT32.EXEWINWORD.EXEwhesilo743.exewhesilo743.exe

description	pid	process	target process
PID 776 wrote to memory of 1672	776	EQNEDT32.EXE	whesilo743.exe
PID 776 wrote to memory of 1672	776	EQNEDT32.EXE	whesilo743.exe
PID 776 wrote to memory of 1672	776	EQNEDT32.EXE	whesilo743.exe
PID 776 wrote to memory of 1672	776	EQNEDT32.EXE	whesilo743.exe
PID 1956 wrote to memory of 1548	1956	WINWORD.EXE	splwow64.exe
PID 1956 wrote to memory of 1548	1956	WINWORD.EXE	splwow64.exe
PID 1956 wrote to memory of 1548	1956	WINWORD.EXE	splwow64.exe
PID 1956 wrote to memory of 1548	1956	WINWORD.EXE	splwow64.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1672 wrote to memory of 1696	1672	whesilo743.exe	whesilo743.exe
PID 1696 wrote to memory of 776	1696	whesilo743.exe	WerFault.exe
PID 1696 wrote to memory of 776	1696	whesilo743.exe	WerFault.exe
PID 1696 wrote to memory of 776	1696	whesilo743.exe	WerFault.exe
PID 1696 wrote to memory of 776	1696	whesilo743.exe	WerFault.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TRACKING NUMBER.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:1548

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Roaming\whesilo743.exe
"C:\Users\Admin\AppData\Roaming\whesilo743.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Roaming\whesilo743.exe
"C:\Users\Admin\AppData\Roaming\whesilo743.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1052
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
C:\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
C:\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
\Users\Admin\AppData\Roaming\whesilo743.exe
MD5
573a705d5e0d497295ea03ac32056f8f

SHA1
22da991da46c925251c0d509cdaa6cad50e3ebe1

SHA256
74f9d0543c52f4e3cc068134a69edaea6af7d715874efc4acd643991f28f3de3

SHA512
59399a3c87b2157485ca25899c018d98c8dea6572a918bb5c2984f6b24c86fbe2e76fac87625ab05e782a4f1ca655eb71c1a225ccccc25e722344294b22fa515

Download Submit
memory/776-83-0x0000000000000000-mapping.dmp

Download
memory/776-89-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1548-73-0x0000000000000000-mapping.dmp

Download
memory/1548-74-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp

Filesize
8KB

Download
memory/1672-71-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1672-72-0x00000000003C0000-0x00000000003CB000-memory.dmp

Filesize
44KB

Download
memory/1672-75-0x0000000009040000-0x00000000090A3000-memory.dmp

Filesize
396KB

Download
memory/1672-76-0x0000000000800000-0x0000000000826000-memory.dmp

Filesize
152KB

Download
memory/1672-66-0x0000000000000000-mapping.dmp

Download
memory/1672-69-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1696-80-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-82-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/1696-77-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-78-0x000000000041F89E-mapping.dmp

Download
memory/1956-60-0x0000000072DB1000-0x0000000072DB4000-memory.dmp

Filesize
12KB

Download
memory/1956-63-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1956-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1956-61-0x0000000070831000-0x0000000070833000-memory.dmp

Filesize
8KB

Download
memory/1956-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download