snakekeylogger | db2ecbc435d932b7947857e4f9108ffe48c7a5af8ad9a34836c9d6cd96193ed0

General

Target

BL_SHIPPING_DOC.js
Size

248KB
MD5

c895f5dae03d1e6030775e0161975b14
SHA1

18c28bce01ba6d6e3fce7bdf568baf302dac77df
SHA256

db2ecbc435d932b7947857e4f9108ffe48c7a5af8ad9a34836c9d6cd96193ed0
SHA512

5ebc550b39310edd80b58ceb155863044c34c569d9c223bc587aed150bc26d65ae7dfc9ce219ae4948fa5efb38abcb525702991e99f0690d4a01522ed55f371d

Score

10^/10

snakekeylogger vjw0rm keylogger persistence spyware stealer trojan worm

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1923344551:AAGJ9MeV4yHipzEdvvxVuepm8PFUNaCZez4/sendMessage?chat_id=1208289397

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 19 IoCs

Processes:

wscript.exe

flow	pid	process
7	1032	wscript.exe
20	1032	wscript.exe
23	1032	wscript.exe
24	1032	wscript.exe
25	1032	wscript.exe
26	1032	wscript.exe
27	1032	wscript.exe
28	1032	wscript.exe
29	1032	wscript.exe
30	1032	wscript.exe
31	1032	wscript.exe
32	1032	wscript.exe
33	1032	wscript.exe
34	1032	wscript.exe
35	1032	wscript.exe
36	1032	wscript.exe
37	1032	wscript.exe
38	1032	wscript.exe
39	1032	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

snaktele.exe

pid process

1652 snaktele.exe

pid	process
1652	snaktele.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgUmkOJCzD.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tgUmkOJCzD.js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\tgUmkOJCzD.js\""	wscript.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 checkip.dyndns.org
12 freegeoip.app
13 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

snaktele.exe

pid process

1652 snaktele.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

snaktele.exe

description pid process

Token: SeDebugPrivilege 1652 snaktele.exe

flow	ioc
8	checkip.dyndns.org
12	freegeoip.app
13	freegeoip.app

pid	process
1652	snaktele.exe

description	pid	process
Token: SeDebugPrivilege	1652	snaktele.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 3424 wrote to memory of 1032	3424	wscript.exe	wscript.exe
PID 3424 wrote to memory of 1032	3424	wscript.exe	wscript.exe
PID 3424 wrote to memory of 1652	3424	wscript.exe	snaktele.exe
PID 3424 wrote to memory of 1652	3424	wscript.exe	snaktele.exe
PID 3424 wrote to memory of 1652	3424	wscript.exe	snaktele.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\BL_SHIPPING_DOC.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\tgUmkOJCzD.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1032

C:\Users\Admin\AppData\Local\Temp\snaktele.exe
"C:\Users\Admin\AppData\Local\Temp\snaktele.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\snaktele.exe
MD5
2c94dd555d927ad1bee732c64d4dec5e

SHA1
1f8faf2cd27eae38ed505998ceaee96674df8332

SHA256
dc157362e9c0469b3d8909770c5879a1e5cbaa6ae5e0d8203c536cbce6131901

SHA512
5e529a63affe17f7019a696f50b0619d4238433b535dc55d25b85c640c8fe17cd7caf7b67c1309696e72316bca1524c06a8be2c13da382d3bd40e510774d9bc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\snaktele.exe
MD5
2c94dd555d927ad1bee732c64d4dec5e

SHA1
1f8faf2cd27eae38ed505998ceaee96674df8332

SHA256
dc157362e9c0469b3d8909770c5879a1e5cbaa6ae5e0d8203c536cbce6131901

SHA512
5e529a63affe17f7019a696f50b0619d4238433b535dc55d25b85c640c8fe17cd7caf7b67c1309696e72316bca1524c06a8be2c13da382d3bd40e510774d9bc2

Download Submit
C:\Users\Admin\AppData\Roaming\tgUmkOJCzD.js
MD5
d1b42ee3ac80dd876017486a660d88a8

SHA1
ceadc2cf10e0200760e440a193a648fb0b031f17

SHA256
3cff9797b33d5d2f101ad92f319039e172a5472404f5df27d72c8936dad729b4

SHA512
f6f7c5d102ff170909a10a83d3115771739fa52977a4972bc01cd0cd54e673795d56f8f346e1bb2086efd825465b56c0c0dcc582e1f3b023b9971d664cab6736

Download Submit
memory/1032-114-0x0000000000000000-mapping.dmp

Download
memory/1652-116-0x0000000000000000-mapping.dmp

Download
memory/1652-119-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/1652-121-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/1652-122-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/1652-123-0x0000000005550000-0x0000000005A4E000-memory.dmp

Filesize
5.0MB

Download
memory/1652-124-0x0000000006820000-0x0000000006821000-memory.dmp

Filesize
4KB

Download
memory/1652-125-0x00000000066F0000-0x00000000066F1000-memory.dmp

Filesize
4KB

Download
memory/1652-126-0x0000000006690000-0x0000000006691000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads