snakekeylogger | 5e78cf499e73d06b346f84de0a36188587cb0789a9a02899d3e5d0dcd4a15520

General

Target
PR NO 132.pdf.exe
Size 580KB
Sample220511-dvrlvahfak
SHA256 5e78cf499e73d06b346f84de0a36188587cb0789a9a02899d3e5d0dcd4a15520
MD5 ac94b0e54b9334f25c1ee1aa29834b26
SHA1 2051c396be3542324b0c2b06dcc7f8651cc5d5e8
SHA512 32498c361397c96d2e75f12ded932fdb320188d631ff50a1f279d833eb840778e9d01576a9e7f7cd5958bc7ba5dd8b3be026ecc18cdfb5bdcbb4f1352eed60c3
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.skyshine.com.my
Port
587
Username
[email protected]
Password
inthesky2022
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1328-62-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-66-0x00000000004202BE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1328-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1776 set thread context of 1328	1776	PR NO 132.pdf.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	PR NO 132.pdf.exe
1328	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	PR NO 132.pdf.exe
Token: SeDebugPrivilege	1328	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1160	1776	PR NO 132.pdf.exe	28
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29
PID 1776 wrote to memory of 1328	1776	PR NO 132.pdf.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PR NO 132.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PR NO 132.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-59-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-60-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-62-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-64-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-65-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-70-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-68-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1776-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

Download

memory/1776-56-0x0000000000390000-0x0000000000398000-memory.dmp

Download

memory/1776-57-0x0000000005450000-0x00000000054D0000-memory.dmp

Download

memory/1776-58-0x0000000001F90000-0x0000000001FC0000-memory.dmp

Download

memory/1776-54-0x0000000000960000-0x00000000009F4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads