snakekeylogger | ff7c332b77194f5bafb276ac4eaa038e5014d8bc546cb49b565156581cef3449

Analysis

max time kernel
58s
max time network
125s
platform
windows7_x64
resource
win7-20220331-en
submitted
12/04/2022, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
duONZIw23uNXjKY.exe
Size 572KB
Sample220412-gcv34afdfl
SHA256 ff7c332b77194f5bafb276ac4eaa038e5014d8bc546cb49b565156581cef3449
MD5 bfdc4a7009d813394e0889036fafc421
SHA1 7ddae09a11fc537300bd9d4986ee92b9c7c70cc8
SHA512 d2efd8eb3a030a5ebc1cbd0f933d15ee0f0a2f63e38f776eb4bc3e78ce2bba690089cba5a275956700c5f5a73c0362d66db0c7a9493db29819e1282034695765
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5243953302:AAGFyxwcILx3S0Gq834R9NN-9m6enfFssYk/sendMessage?chat_id=5255359287

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

resource	yara_rule
behavioral1/memory/860-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/860-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/860-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/860-69-0x000000000042033E-mapping.dmp	family_snakekeylogger
behavioral1/memory/860-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/860-73-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 860	1164	duONZIw23uNXjKY.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1864	860	WerFault.exe	32

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
860	duONZIw23uNXjKY.exe
1472	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	duONZIw23uNXjKY.exe
Token: SeDebugPrivilege	1472	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1472	1164	duONZIw23uNXjKY.exe	28
PID 1164 wrote to memory of 1472	1164	duONZIw23uNXjKY.exe	28
PID 1164 wrote to memory of 1472	1164	duONZIw23uNXjKY.exe	28
PID 1164 wrote to memory of 1472	1164	duONZIw23uNXjKY.exe	28
PID 1164 wrote to memory of 1368	1164	duONZIw23uNXjKY.exe	30
PID 1164 wrote to memory of 1368	1164	duONZIw23uNXjKY.exe	30
PID 1164 wrote to memory of 1368	1164	duONZIw23uNXjKY.exe	30
PID 1164 wrote to memory of 1368	1164	duONZIw23uNXjKY.exe	30
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 1164 wrote to memory of 860	1164	duONZIw23uNXjKY.exe	32
PID 860 wrote to memory of 1864	860	duONZIw23uNXjKY.exe	33
PID 860 wrote to memory of 1864	860	duONZIw23uNXjKY.exe	33
PID 860 wrote to memory of 1864	860	duONZIw23uNXjKY.exe	33
PID 860 wrote to memory of 1864	860	duONZIw23uNXjKY.exe	33

C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe
"C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UKKSZWf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UKKSZWf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA9E7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1368
- C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe
  "C:\Users\Admin\AppData\Local\Temp\duONZIw23uNXjKY.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 1104
    3⤵
    - Program crash
    PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpA9E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA9E7.tmp
Size 1KB
SHA256 f70e599ae7bf9f1763cc0fbc9316c200f8bd0fff222c2637faa5c200070e83e8
MD5 efc6d73cd3e14da8cf7312341263a2ed
SHA1 238247c9bac0be59c466f6346e65212dba94b122
SHA512 6bc408c9242fcd825693586f3845d942f45bbb8ffbe1d85ac7ad2a2c954da70b0ba058c494a6f93e04533454f420fbc28f13d4e8a6562fdc17175a4547e214f2
MD5 SHA1 SHA512

Submit Download

memory/860-68-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/860-71-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/860-73-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/860-63-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/860-65-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/860-67-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/860-62-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1164-56-0x0000000004920000-0x000000000498A000-memory.dmp

Download

memory/1164-61-0x0000000005040000-0x0000000005066000-memory.dmp

Download

memory/1164-55-0x0000000000360000-0x000000000036E000-memory.dmp

Download

memory/1164-54-0x0000000000200000-0x0000000000294000-memory.dmp

Download

memory/1472-59-0x0000000075461000-0x0000000075463000-memory.dmp

Download

memory/1472-74-0x000000006E470000-0x000000006EA1B000-memory.dmp

Download

memory/1472-75-0x00000000022C0000-0x00000000022C8000-memory.dmp

Download