snakekeylogger | 75f7a5b155426bf485770e395bac90894eee5f8d1742f774429d726f7a5156bc

General

Target

Order.009993337.exe
Size

550KB
MD5

d2360fe15b37eb34a479aefa87fa48e3
SHA1

b812bb43a88e0f63558c646615c693347ebbbf7a
SHA256

75f7a5b155426bf485770e395bac90894eee5f8d1742f774429d726f7a5156bc
SHA512

669c9f76a06103ab59f1e2b4a8bccbc5005c1b82dd80279820ead3470c3cdd148081297e1b3e9c895584a52e5ff7f596735108b6272989e925c1a2fca725c9ab

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.greentrading.com.pk
Port:
26
Username:
info@greentrading.com.pk
Password:
lovetoall

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/700-57-0x0000000000400000-0x0000000000477000-memory.dmp	family_snakekeylogger
behavioral1/memory/700-58-0x000000000040188B-mapping.dmp	family_snakekeylogger
behavioral1/memory/700-60-0x0000000000400000-0x0000000000477000-memory.dmp	family_snakekeylogger
behavioral1/memory/700-62-0x00000000044B0000-0x0000000004512000-memory.dmp	family_snakekeylogger

Loads dropped DLL 1 IoCs

Processes:

Order.009993337.exe

pid process

524 Order.009993337.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
9 freegeoip.app
10 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Order.009993337.exe

description pid process target process

PID 524 set thread context of 700 524 Order.009993337.exe Order.009993337.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Order.009993337.exe

pid process

700 Order.009993337.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Order.009993337.exe

description pid process

Token: SeDebugPrivilege 700 Order.009993337.exe

pid	process
524	Order.009993337.exe

flow	ioc
4	checkip.dyndns.org
9	freegeoip.app
10	freegeoip.app

description	pid	process	target process
PID 524 set thread context of 700	524	Order.009993337.exe	Order.009993337.exe

pid	process
700	Order.009993337.exe

description	pid	process
Token: SeDebugPrivilege	700	Order.009993337.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Order.009993337.exe

description	pid	process	target process
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe
PID 524 wrote to memory of 700	524	Order.009993337.exe	Order.009993337.exe

C:\Users\Admin\AppData\Local\Temp\Order.009993337.exe
"C:\Users\Admin\AppData\Local\Temp\Order.009993337.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\Order.009993337.exe
"C:\Users\Admin\AppData\Local\Temp\Order.009993337.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdDC.tmp\xavyndwlgi.dll
MD5
0c468f1d3cf1d1c8c9db621c50ba45ae

SHA1
51070b75b565a4d85580063e259c619d71cdd70d

SHA256
2018066b44fa27056bf2b52bed7bf5c3dfe4c8a146bb209aeede273afe7c1fda

SHA512
e03a3a0da23bb4bbc768ed3ee00456d4bbb27238f4faa6afa017d85cf9e10293b14ced4072568865398c26ab3e2489406f435560020f20c80efc9190f788189d

Download Submit
memory/524-55-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/700-57-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/700-58-0x000000000040188B-mapping.dmp

Download
memory/700-60-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/700-61-0x0000000001F41000-0x0000000001F42000-memory.dmp

Filesize
4KB

Download
memory/700-62-0x00000000044B0000-0x0000000004512000-memory.dmp

Filesize
392KB

Download
memory/700-65-0x0000000001F43000-0x0000000001F44000-memory.dmp

Filesize
4KB

Download
memory/700-64-0x0000000001F42000-0x0000000001F43000-memory.dmp

Filesize
4KB

Download
memory/700-66-0x0000000001F44000-0x0000000001F45000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing