snakekeylogger | 71e8044a55f0f599c6b0d3e19981fa6c6eda849f7041b9b86d71ec9287af060e

General

Target
210927,pdf.exe
Size 328KB
Sample211006-et8peaaec5
SHA256 71e8044a55f0f599c6b0d3e19981fa6c6eda849f7041b9b86d71ec9287af060e
MD5 5e4428b6d935102a295242ee3a3b9f8f
SHA1 81ceef1f4b35c1f5dd87fe22d115bdb4c42030eb
SHA512 e8c7d2aa1fb5dc7f65a71cfbf1c969e91c4ada92ff10972ebcd192c11ed900fa758e3e89e1143a41b893e57e6ad38441b01d152f8b67b728db49585e4198f95b
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 2012	1724	210927,pdf.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	210927,pdf.exe
Token: SeDebugPrivilege	2012	210927,pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1616	1724	210927,pdf.exe	27
PID 1724 wrote to memory of 1616	1724	210927,pdf.exe	27
PID 1724 wrote to memory of 1616	1724	210927,pdf.exe	27
PID 1724 wrote to memory of 1616	1724	210927,pdf.exe	27
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29
PID 1724 wrote to memory of 2012	1724	210927,pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\210927,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\210927,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VEyImYE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA514.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1616
- C:\Users\Admin\AppData\Local\Temp\210927,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\210927,pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2012