snakekeylogger | d87f01761f2fab9471424463590a2013da8df236dbb8ab22ac48bb9a039530e1

Analysis

max time kernel
56s
max time network
125s
platform
windows7_x64
resource
win7-20220331-en
submitted
04/04/2022, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5b8a8cc1a38d187c135b1bb57b77e26f.exe
Size 1.0MB
Sample220404-mc4ccsdee6
SHA256 d87f01761f2fab9471424463590a2013da8df236dbb8ab22ac48bb9a039530e1
MD5 5b8a8cc1a38d187c135b1bb57b77e26f
SHA1 aa906cebfb81e01085b03dff1ec7a1cebfd7cc4a
SHA512 026bf69e730199674020adc8c331156876da3b07db712a8efe0919527ccb0e260928efd0df3ccfb7c35332c8dc79393bfce9fbefc10920e7e479c65bec353699
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
webmail.microjoining.com
Port
587
Username
[email protected]
Password
micro1
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1508-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1508-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1508-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1508-69-0x000000000042046E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1508-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1508-73-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	1508	WerFault.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1508	5b8a8cc1a38d187c135b1bb57b77e26f.exe
1436	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	5b8a8cc1a38d187c135b1bb57b77e26f.exe
Token: SeDebugPrivilege	1436	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 1436	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	28
PID 1832 wrote to memory of 1436	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	28
PID 1832 wrote to memory of 1436	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	28
PID 1832 wrote to memory of 1436	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	28
PID 1832 wrote to memory of 1692	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	30
PID 1832 wrote to memory of 1692	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	30
PID 1832 wrote to memory of 1692	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	30
PID 1832 wrote to memory of 1692	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	30
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1832 wrote to memory of 1508	1832	5b8a8cc1a38d187c135b1bb57b77e26f.exe	32
PID 1508 wrote to memory of 1688	1508	5b8a8cc1a38d187c135b1bb57b77e26f.exe	33
PID 1508 wrote to memory of 1688	1508	5b8a8cc1a38d187c135b1bb57b77e26f.exe	33
PID 1508 wrote to memory of 1688	1508	5b8a8cc1a38d187c135b1bb57b77e26f.exe	33
PID 1508 wrote to memory of 1688	1508	5b8a8cc1a38d187c135b1bb57b77e26f.exe	33

C:\Users\Admin\AppData\Local\Temp\5b8a8cc1a38d187c135b1bb57b77e26f.exe
"C:\Users\Admin\AppData\Local\Temp\5b8a8cc1a38d187c135b1bb57b77e26f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aHjAUiTfvd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aHjAUiTfvd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DA7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\5b8a8cc1a38d187c135b1bb57b77e26f.exe
  "C:\Users\Admin\AppData\Local\Temp\5b8a8cc1a38d187c135b1bb57b77e26f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1104
    3⤵
    - Program crash
    PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp9DA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp9DA7.tmp
Size 1KB
SHA256 493190ea45887a1e57a1d376921a5bcf0974639832b5a5cc87d808ae6cc29bc9
MD5 62a076b211f4087082a513045a5c61cf
SHA1 01e7305a0c9ef8105529a4b4cfeab970fbf9dab6
SHA512 6404f0a56633583774f76781fc00e83f0b7b00c888d401e49b399027d7cc803ee9c1228ab1921b63d4dfe98a24b4ff82c559197cd4a8b2f1bd6172a185a47b21
MD5 SHA1 SHA512

Submit Download

memory/1436-59-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Download

memory/1436-75-0x0000000002540000-0x000000000318A000-memory.dmp

Download

memory/1436-74-0x00000000704E0000-0x0000000070A8B000-memory.dmp

Download

memory/1508-68-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1508-73-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1508-71-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1508-62-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1508-63-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1508-65-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1508-67-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1832-54-0x00000000011B0000-0x00000000012BA000-memory.dmp

Download

memory/1832-61-0x0000000005180000-0x00000000051A6000-memory.dmp

Download

memory/1832-56-0x0000000007DE0000-0x0000000007ECE000-memory.dmp

Download

memory/1832-55-0x00000000005A0000-0x00000000005AA000-memory.dmp

Download