snakekeylogger | e3b25e21c6d04b5f2d72025c7956dbc3a4a5613f3b8d7ab8d0010bc3d437bc1b

General

Target

baa34a47a3e304011252780a85ae56be.exe
Size

257KB
MD5

baa34a47a3e304011252780a85ae56be
SHA1

77aaae6ca43345f9dd9871c637176634b4ec5f09
SHA256

e3b25e21c6d04b5f2d72025c7956dbc3a4a5613f3b8d7ab8d0010bc3d437bc1b
SHA512

6c0e07dbf351b5c04d50e08c9f684559f14982096762f1bbc64d4ffe86f6adf0bcf080f08b1032ced59dd3abe47d8701a9d99efc92d6b6c854d879fec6f246d9

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1816395306:AAE3ZBLYV2L9aT9mL8itL9vr3RP6nOz_B1o/sendMessage?chat_id=1368673464

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Loads dropped DLL 1 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exe

pid process

4648 baa34a47a3e304011252780a85ae56be.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exe

description pid process target process

PID 4648 set thread context of 4684 4648 baa34a47a3e304011252780a85ae56be.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

4684 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

MSBuild.exe

pid process

4684 MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exe

pid process

4648 baa34a47a3e304011252780a85ae56be.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 4684 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

4684 MSBuild.exe

pid	process
4648	baa34a47a3e304011252780a85ae56be.exe

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app

description	pid	process	target process
PID 4648 set thread context of 4684	4648	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe

pid	process
4684	MSBuild.exe

pid	process
4684	MSBuild.exe

pid	process
4648	baa34a47a3e304011252780a85ae56be.exe

description	pid	process
Token: SeDebugPrivilege	4684	MSBuild.exe

pid	process
4684	MSBuild.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

baa34a47a3e304011252780a85ae56be.exeMSBuild.exe

description	pid	process	target process
PID 4648 wrote to memory of 4684	4648	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 4648 wrote to memory of 4684	4648	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 4648 wrote to memory of 4684	4648	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 4648 wrote to memory of 4684	4648	baa34a47a3e304011252780a85ae56be.exe	MSBuild.exe
PID 4684 wrote to memory of 4756	4684	MSBuild.exe	netsh.exe
PID 4684 wrote to memory of 4756	4684	MSBuild.exe	netsh.exe
PID 4684 wrote to memory of 4756	4684	MSBuild.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\baa34a47a3e304011252780a85ae56be.exe
"C:\Users\Admin\AppData\Local\Temp\baa34a47a3e304011252780a85ae56be.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\baa34a47a3e304011252780a85ae56be.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:4756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsk57A1.tmp\rocn.dll
MD5
20e0ca41c8419f551c52aa86700b5074

SHA1
e2a47c15342f874e051b18b577eca2c49ab99782

SHA256
fde9673e0878783412ae8d1848316601f2f3b567a3688694b42d745fe18f14a0

SHA512
0a726b78493a0f8ba01133d12670977e51fc1f1d878b0e389c59f03cb80decb5d50411a88058d6e466c9cfe1ca02c1ffbdb9f1fb855249c0cc351efcc4541a28

Download Submit
memory/4684-115-0x000000000042070E-mapping.dmp

Download
memory/4684-116-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4684-118-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/4684-119-0x0000000005330000-0x0000000005331000-memory.dmp

Filesize
4KB

Download
memory/4684-120-0x0000000005240000-0x000000000573E000-memory.dmp

Filesize
5.0MB

Download
memory/4684-122-0x00000000063E0000-0x00000000063E1000-memory.dmp

Filesize
4KB

Download
memory/4684-123-0x0000000006750000-0x0000000006751000-memory.dmp

Filesize
4KB

Download
memory/4684-124-0x0000000006710000-0x0000000006711000-memory.dmp

Filesize
4KB

Download
memory/4684-125-0x0000000005240000-0x000000000573E000-memory.dmp

Filesize
5.0MB

Download
memory/4756-121-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing