snakekeylogger | 5e78cf499e73d06b346f84de0a36188587cb0789a9a02899d3e5d0dcd4a15520

General

Target
PR NO 132.pdf.exe
Size 580KB
Sample220511-dvrlvahfak
SHA256 5e78cf499e73d06b346f84de0a36188587cb0789a9a02899d3e5d0dcd4a15520
MD5 ac94b0e54b9334f25c1ee1aa29834b26
SHA1 2051c396be3542324b0c2b06dcc7f8651cc5d5e8
SHA512 32498c361397c96d2e75f12ded932fdb320188d631ff50a1f279d833eb840778e9d01576a9e7f7cd5958bc7ba5dd8b3be026ecc18cdfb5bdcbb4f1352eed60c3
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.skyshine.com.my
Port
587
Username
[email protected]
Password
inthesky2022
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4304-137-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1200 set thread context of 4304	1200	PR NO 132.pdf.exe	90

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4304	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90
PID 1200 wrote to memory of 4304	1200	PR NO 132.pdf.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PR NO 132.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PR NO 132.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-130-0x0000000000720000-0x00000000007B4000-memory.dmp

Download

memory/1200-131-0x0000000005750000-0x0000000005CF4000-memory.dmp

Download

memory/1200-132-0x00000000051A0000-0x0000000005232000-memory.dmp

Download

memory/1200-133-0x0000000005140000-0x000000000514A000-memory.dmp

Download

memory/1200-134-0x0000000007AD0000-0x0000000007B6C000-memory.dmp

Download

memory/1200-135-0x0000000007D90000-0x0000000007DF6000-memory.dmp

Download

memory/4304-137-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4304-138-0x0000000006690000-0x0000000006852000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads