snakekeylogger | af41223eb9daa98fea5555e90a232634848bcc1801315a6f47edf20bbe086d3f

Analysis

max time kernel
121s
max time network
125s
platform
windows10_x64
resource
win10v20210408
submitted
19/09/2021, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc03589320210903102516.pdf.exe
Size 507KB
Sample210919-vcadaaehcl
SHA256 af41223eb9daa98fea5555e90a232634848bcc1801315a6f47edf20bbe086d3f
MD5 43dae041e750892c11d22ec7422748ac
SHA1 bdb49a7414926d44d81c2e2a579be53701f7f1d1
SHA512 d1a74f6b1ae47f464993fc6743f468c1f2ebba44d28120d349a1909ef45a7bcf904a090061277e27b2902255ef2a1b156f5ae7d4d9ab5875e262f9b64f8c46f8
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
smtp.gmail.com
Port
587
Username
[email protected]
Password
Ai124578Ai

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Executes dropped EXE 1 IoCs

pid	Process
1424	uyfdfgh.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org
3	freegeoip.app
4	freegeoip.app
15	freegeoip.app

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 2016	648	doc03589320210903102516.pdf.exe	75
PID 1424 set thread context of 2696	1424	uyfdfgh.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1788	schtasks.exe
2736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2016	vbc.exe
2696	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	vbc.exe
Token: SeDebugPrivilege	2696	vbc.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1072	648	doc03589320210903102516.pdf.exe	68
PID 648 wrote to memory of 1072	648	doc03589320210903102516.pdf.exe	68
PID 648 wrote to memory of 1072	648	doc03589320210903102516.pdf.exe	68
PID 648 wrote to memory of 1112	648	doc03589320210903102516.pdf.exe	69
PID 648 wrote to memory of 1112	648	doc03589320210903102516.pdf.exe	69
PID 648 wrote to memory of 1112	648	doc03589320210903102516.pdf.exe	69
PID 648 wrote to memory of 1212	648	doc03589320210903102516.pdf.exe	72
PID 648 wrote to memory of 1212	648	doc03589320210903102516.pdf.exe	72
PID 648 wrote to memory of 1212	648	doc03589320210903102516.pdf.exe	72
PID 1072 wrote to memory of 1788	1072	cmd.exe	74
PID 1072 wrote to memory of 1788	1072	cmd.exe	74
PID 1072 wrote to memory of 1788	1072	cmd.exe	74
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 648 wrote to memory of 2016	648	doc03589320210903102516.pdf.exe	75
PID 1424 wrote to memory of 2236	1424	uyfdfgh.exe	84
PID 1424 wrote to memory of 2236	1424	uyfdfgh.exe	84
PID 1424 wrote to memory of 2236	1424	uyfdfgh.exe	84
PID 1424 wrote to memory of 2440	1424	uyfdfgh.exe	86
PID 1424 wrote to memory of 2440	1424	uyfdfgh.exe	86
PID 1424 wrote to memory of 2440	1424	uyfdfgh.exe	86
PID 1424 wrote to memory of 3164	1424	uyfdfgh.exe	87
PID 1424 wrote to memory of 3164	1424	uyfdfgh.exe	87
PID 1424 wrote to memory of 3164	1424	uyfdfgh.exe	87
PID 2236 wrote to memory of 2736	2236	cmd.exe	90
PID 2236 wrote to memory of 2736	2236	cmd.exe	90
PID 2236 wrote to memory of 2736	2236	cmd.exe	90
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91
PID 1424 wrote to memory of 2696	1424	uyfdfgh.exe	91

C:\Users\Admin\AppData\Local\Temp\doc03589320210903102516.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\doc03589320210903102516.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\uyfdfgh.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\uyfdfgh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:1788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\doc03589320210903102516.pdf.exe" "C:\Users\Admin\AppData\Roaming\uyfdfgh.exe"
  2⤵
  PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /fdsfs
  2⤵
  PID:1212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016

C:\Users\Admin\AppData\Roaming\uyfdfgh.exe
C:\Users\Admin\AppData\Roaming\uyfdfgh.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\uyfdfgh.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "NanoShield" /tr "'C:\Users\Admin\AppData\Roaming\uyfdfgh.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\uyfdfgh.exe" "C:\Users\Admin\AppData\Roaming\uyfdfgh.exe"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /fdsfs
  2⤵
  PID:3164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-116-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Download

memory/648-117-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download

memory/648-118-0x00000000055F0000-0x0000000005AEE000-memory.dmp

Download

memory/648-119-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/648-114-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/1424-847-0x0000000005920000-0x0000000005E1E000-memory.dmp

Download

memory/2016-132-0x0000000009480000-0x0000000009481000-memory.dmp

Download

memory/2016-820-0x000000000A640000-0x000000000A641000-memory.dmp

Download

memory/2016-133-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Download

memory/2016-124-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2696-896-0x00000000091C0000-0x00000000096BE000-memory.dmp

Download