snakekeylogger | bb5aa33ec1181af72cf4422a71bbf8a7d594f4c9522e3ed91f0a241609ab530f

General

Target

payslip.exe
Size

938KB
MD5

b39ebd7f3b8e407bdcaf2c7351ad8ae0
SHA1

b4992a53a9d2e624d1fb2427ae712c5c0b6ba916
SHA256

bb5aa33ec1181af72cf4422a71bbf8a7d594f4c9522e3ed91f0a241609ab530f
SHA512

b96dacd6b4042a3cb5b7c54878bc51d05b5aacdcf5595158bd536c5035bb65b4b051f67d0bc2d7b0de0fcadbd4ca28c7a9c240c0261ad6aee17766fb2346010a

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.stlwtgroup.com
Port:
587
Username:
simon.ho@stlwtgroup.com
Password:
Simon97292457

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
9 freegeoip.app
10 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

payslip.exe

description pid process target process

PID 1696 set thread context of 1612 1696 payslip.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegSvcs.exe

pid process

1612 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1612 RegSvcs.exe

flow	ioc
4	checkip.dyndns.org
9	freegeoip.app
10	freegeoip.app

description	pid	process	target process
PID 1696 set thread context of 1612	1696	payslip.exe	RegSvcs.exe

pid	process
1612	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1612	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

payslip.exe

description	pid	process	target process
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe
PID 1696 wrote to memory of 1612	1696	payslip.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\payslip.exe
"C:\Users\Admin\AppData\Local\Temp\payslip.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1612-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1612-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1612-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1612-65-0x00000000004203FE-mapping.dmp

Download
memory/1612-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1612-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1612-68-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/1696-55-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1696-57-0x0000000000510000-0x0000000000515000-memory.dmp

Filesize
20KB

Download
memory/1696-58-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1696-59-0x0000000005540000-0x000000000564A000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads