snakekeylogger | 5ff91ab46e1a82df8a7efffc4175fa68a42fb1452e17b64041c6d570c87d8fd4

General

Target

ISO-77002387418602.bin.exe
Size

558KB
MD5

3446b3427eb52e09af7b7424d8bd6dc3
SHA1

780f36db6bdafed0966c2951e86142b43105f0f2
SHA256

0cc6f444f52c66cd955fa64184e8784b8ec735a0d8b2f1f4c060532fcd54e9f8
SHA512

7596395c37d037bff11dcf9e3f59039602b965c9cd36fedf344ef83dff3cce5c80aec345d4eaee4ecc2b5036b6a34473f7f31d3291d651baeddad762e5c7fbfe

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
budgetn.shop
Port:
587
Username:
[email protected]
Password:
eC~Z,TG&S9jM

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Executes dropped EXE 1 IoCs

Processes:

dfxzdg.exe

pid process

1312 dfxzdg.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1312	dfxzdg.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

vbc.exevbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
14 freegeoip.app
4 checkip.dyndns.org

flow	ioc
8	freegeoip.app
9	freegeoip.app
14	freegeoip.app
4	checkip.dyndns.org

Suspicious use of SetThreadContext 2 IoCs

Processes:

ISO-77002387418602.bin.exedfxzdg.exe

description	pid	process	target process
PID 1284 set thread context of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1312 set thread context of 932	1312	dfxzdg.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2024 schtasks.exe
1292 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exevbc.exe

pid process

1368 vbc.exe
932 vbc.exe

pid	process
2024	schtasks.exe
1292	schtasks.exe

pid	process
1368	vbc.exe
932	vbc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ISO-77002387418602.bin.exevbc.exedfxzdg.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1284	ISO-77002387418602.bin.exe
Token: SeDebugPrivilege	1368	vbc.exe
Token: SeDebugPrivilege	1312	dfxzdg.exe
Token: SeDebugPrivilege	932	vbc.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

ISO-77002387418602.bin.execmd.exetaskeng.exedfxzdg.execmd.exe

description	pid	process	target process
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 1368	1284	ISO-77002387418602.bin.exe	vbc.exe
PID 1284 wrote to memory of 804	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 804	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 804	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 804	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 696	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 696	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 696	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 1284 wrote to memory of 696	1284	ISO-77002387418602.bin.exe	cmd.exe
PID 804 wrote to memory of 2024	804	cmd.exe	schtasks.exe
PID 804 wrote to memory of 2024	804	cmd.exe	schtasks.exe
PID 804 wrote to memory of 2024	804	cmd.exe	schtasks.exe
PID 804 wrote to memory of 2024	804	cmd.exe	schtasks.exe
PID 1500 wrote to memory of 1312	1500	taskeng.exe	dfxzdg.exe
PID 1500 wrote to memory of 1312	1500	taskeng.exe	dfxzdg.exe
PID 1500 wrote to memory of 1312	1500	taskeng.exe	dfxzdg.exe
PID 1500 wrote to memory of 1312	1500	taskeng.exe	dfxzdg.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 932	1312	dfxzdg.exe	vbc.exe
PID 1312 wrote to memory of 1800	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1800	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1800	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1800	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1668	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1668	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1668	1312	dfxzdg.exe	cmd.exe
PID 1312 wrote to memory of 1668	1312	dfxzdg.exe	cmd.exe
PID 1800 wrote to memory of 1292	1800	cmd.exe	schtasks.exe
PID 1800 wrote to memory of 1292	1800	cmd.exe	schtasks.exe
PID 1800 wrote to memory of 1292	1800	cmd.exe	schtasks.exe
PID 1800 wrote to memory of 1292	1800	cmd.exe	schtasks.exe

outlook_office_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\ISO-77002387418602.bin.exe
"C:\Users\Admin\AppData\Local\Temp\ISO-77002387418602.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
3⤵
- Creates scheduled task(s)
PID:2024

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\ISO-77002387418602.bin.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
2⤵
PID:696

C:\Windows\system32\taskeng.exe
taskeng.exe {3BE8FB2F-5EC7-49BA-A584-7C414B3B9C8B} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
4⤵
- Creates scheduled task(s)
PID:1292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
3⤵
PID:1668

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
MD5
3446b3427eb52e09af7b7424d8bd6dc3

SHA1
780f36db6bdafed0966c2951e86142b43105f0f2

SHA256
0cc6f444f52c66cd955fa64184e8784b8ec735a0d8b2f1f4c060532fcd54e9f8

SHA512
7596395c37d037bff11dcf9e3f59039602b965c9cd36fedf344ef83dff3cce5c80aec345d4eaee4ecc2b5036b6a34473f7f31d3291d651baeddad762e5c7fbfe

Download Submit
C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
MD5
3446b3427eb52e09af7b7424d8bd6dc3

SHA1
780f36db6bdafed0966c2951e86142b43105f0f2

SHA256
0cc6f444f52c66cd955fa64184e8784b8ec735a0d8b2f1f4c060532fcd54e9f8

SHA512
7596395c37d037bff11dcf9e3f59039602b965c9cd36fedf344ef83dff3cce5c80aec345d4eaee4ecc2b5036b6a34473f7f31d3291d651baeddad762e5c7fbfe

Download Submit
memory/696-73-0x0000000000000000-mapping.dmp

Download
memory/804-72-0x0000000000000000-mapping.dmp

Download
memory/932-86-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/932-87-0x000000000042041E-mapping.dmp

Download
memory/932-89-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/932-93-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/1284-54-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/1284-56-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/1292-92-0x0000000000000000-mapping.dmp

Download
memory/1312-81-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1312-79-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/1312-77-0x0000000000000000-mapping.dmp

Download
memory/1368-63-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1368-60-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1368-57-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1368-70-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/1368-69-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1368-66-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1368-62-0x000000000042041E-mapping.dmp

Download
memory/1368-75-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1368-58-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1368-59-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1624-94-0x000007FEFBE51000-0x000007FEFBE53000-memory.dmp

Filesize
8KB

Download
memory/1668-91-0x0000000000000000-mapping.dmp

Download
memory/1800-88-0x0000000000000000-mapping.dmp

Download
memory/2024-74-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads