snakekeylogger | 55a6538b91bcfc7f276bdc96e863fefd2f6bed25bdac956b67b8606bcfa843bd

Analysis

max time kernel
60s
max time network
197s
platform
windows7_x64
resource
win7-20220414-en
submitted
12/05/2022, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
S0000987654345678900098765.exe
Size 626KB
Sample220512-hal8vadecq
SHA256 55a6538b91bcfc7f276bdc96e863fefd2f6bed25bdac956b67b8606bcfa843bd
MD5 cc92ae8e32081a13928b298af4d3ae68
SHA1 59ec8506d6c05cc849cd012fc38b2a3da8badb26
SHA512 f51ab608890c2d4017688925c5cef43c82777a8ddfaba696c81cbace5b0f91d147fed6bd3d4c3d60c24d699276e2689780569d16cd5d110f1a7e3b69396a55ce
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1620-69-0x0000000000400000-0x000000000048A000-memory.dmp	family_snakekeylogger
behavioral1/memory/1620-70-0x0000000000400000-0x000000000048A000-memory.dmp	family_snakekeylogger
behavioral1/memory/1620-65-0x0000000000401896-mapping.dmp	family_snakekeylogger
behavioral1/memory/1620-64-0x0000000000400000-0x000000000048A000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1580	gbhzxo.exe
1620	gbhzxo.exe

Loads dropped DLL 3 IoCs

pid	Process
904	S0000987654345678900098765.exe
904	S0000987654345678900098765.exe
1580	gbhzxo.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gbhzxo.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gbhzxo.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gbhzxo.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 1620	1580	gbhzxo.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1620	gbhzxo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	gbhzxo.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1580	904	S0000987654345678900098765.exe	28
PID 904 wrote to memory of 1580	904	S0000987654345678900098765.exe	28
PID 904 wrote to memory of 1580	904	S0000987654345678900098765.exe	28
PID 904 wrote to memory of 1580	904	S0000987654345678900098765.exe	28
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29
PID 1580 wrote to memory of 1620	1580	gbhzxo.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gbhzxo.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gbhzxo.exe

C:\Users\Admin\AppData\Local\Temp\S0000987654345678900098765.exe
"C:\Users\Admin\AppData\Local\Temp\S0000987654345678900098765.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe
  C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe C:\Users\Admin\AppData\Local\Temp\lykmsqm
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe
    C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe C:\Users\Admin\AppData\Local\Temp\lykmsqm
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ybw6g7pvf3

Path C:\Users\Admin\AppData\Local\Temp\1ybw6g7pvf3
Size 538KB
SHA256 37d0b37ad177aa83c85349b56bd06ca07a17321482814be6cd1687985220b230
MD5 a3f8e449f7b90cd089113416dc89cc22
SHA1 a78855fb06f60a41bc421735b1931a4eb74c0544
SHA512 36d45b2a719028c611036e2bc4d7b987d15655732cac38e6a3adaf488a0c21b0997c0a8e5533741c0de448614d5642fccbea8cde8332b7ebd16ccf338ec191c4
SSDEEP 12288:X92oC/DZwjMn7qMeUwZYV9Z9Axc22r6l87MolBWYs6x:X92D/DT2yA7tcBjsk
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbhzxo.exe

Path C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe
Size 74KB
SHA256 49bc9edd0da8f02cece2142a48392547453ce943388819404dd4a84a0cb37dd0
MD5 5c0f85d1d2497a2cfcf0d28f5b3a0b17
SHA1 2d8dcda09685d4e7fb3f67bd0a8cd7c402713789
SHA512 fdd2b54be8c29565a66439227f83941820339dc3c76fd0dd52393b6e10ee36742fe575566e817db8d90d70ac41b990e848ea2f132b4c581b29bade5d235f904e
SSDEEP 1536:VoOjKUMbTt7BRUZdqeF0y1ISccfXdasWjcdM43:1jqbZ7Twq8PdFM43
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbhzxo.exe

Path C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe
Size 74KB
SHA256 49bc9edd0da8f02cece2142a48392547453ce943388819404dd4a84a0cb37dd0
MD5 5c0f85d1d2497a2cfcf0d28f5b3a0b17
SHA1 2d8dcda09685d4e7fb3f67bd0a8cd7c402713789
SHA512 fdd2b54be8c29565a66439227f83941820339dc3c76fd0dd52393b6e10ee36742fe575566e817db8d90d70ac41b990e848ea2f132b4c581b29bade5d235f904e
SSDEEP 1536:VoOjKUMbTt7BRUZdqeF0y1ISccfXdasWjcdM43:1jqbZ7Twq8PdFM43
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbhzxo.exe

Path C:\Users\Admin\AppData\Local\Temp\gbhzxo.exe
Size 74KB
SHA256 49bc9edd0da8f02cece2142a48392547453ce943388819404dd4a84a0cb37dd0
MD5 5c0f85d1d2497a2cfcf0d28f5b3a0b17
SHA1 2d8dcda09685d4e7fb3f67bd0a8cd7c402713789
SHA512 fdd2b54be8c29565a66439227f83941820339dc3c76fd0dd52393b6e10ee36742fe575566e817db8d90d70ac41b990e848ea2f132b4c581b29bade5d235f904e
SSDEEP 1536:VoOjKUMbTt7BRUZdqeF0y1ISccfXdasWjcdM43:1jqbZ7Twq8PdFM43
MD5 SHA1 SHA512 SSDEEP

Submit Download

lykmsqm

Path C:\Users\Admin\AppData\Local\Temp\lykmsqm
Size 4KB
SHA256 b6cfcb94c3351608f1772c6fe7a36b3b7650fe1bd09b58c40da6bf724e2de286
MD5 d426366ba5f3b910a2c65f38b2848805
SHA1 70fbdb3684515925f26d2e13c83950bb0be54bbc
SHA512 9e9c0917a174b5d7a620f6bdc744d0603fd44c850e6b566fbe46e2b56dfb69952c7c91e879af477ac4ce88c34e7b894b3f773ae8efb1a4fc10fde23e80e7b30d
SSDEEP 96:X67yTHW3537CyGfol5T7S0wuGtW59UUV7RdNch7n:XDT2353BrPS0wa5bV/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbhzxo.exe

Path \Users\Admin\AppData\Local\Temp\gbhzxo.exe
Size 74KB
SHA256 49bc9edd0da8f02cece2142a48392547453ce943388819404dd4a84a0cb37dd0
MD5 5c0f85d1d2497a2cfcf0d28f5b3a0b17
SHA1 2d8dcda09685d4e7fb3f67bd0a8cd7c402713789
SHA512 fdd2b54be8c29565a66439227f83941820339dc3c76fd0dd52393b6e10ee36742fe575566e817db8d90d70ac41b990e848ea2f132b4c581b29bade5d235f904e
SSDEEP 1536:VoOjKUMbTt7BRUZdqeF0y1ISccfXdasWjcdM43:1jqbZ7Twq8PdFM43
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbhzxo.exe

Path \Users\Admin\AppData\Local\Temp\gbhzxo.exe
Size 74KB
SHA256 49bc9edd0da8f02cece2142a48392547453ce943388819404dd4a84a0cb37dd0
MD5 5c0f85d1d2497a2cfcf0d28f5b3a0b17
SHA1 2d8dcda09685d4e7fb3f67bd0a8cd7c402713789
SHA512 fdd2b54be8c29565a66439227f83941820339dc3c76fd0dd52393b6e10ee36742fe575566e817db8d90d70ac41b990e848ea2f132b4c581b29bade5d235f904e
SSDEEP 1536:VoOjKUMbTt7BRUZdqeF0y1ISccfXdasWjcdM43:1jqbZ7Twq8PdFM43
MD5 SHA1 SHA512 SSDEEP

Submit Download

gbhzxo.exe

Path \Users\Admin\AppData\Local\Temp\gbhzxo.exe
Size 74KB
SHA256 49bc9edd0da8f02cece2142a48392547453ce943388819404dd4a84a0cb37dd0
MD5 5c0f85d1d2497a2cfcf0d28f5b3a0b17
SHA1 2d8dcda09685d4e7fb3f67bd0a8cd7c402713789
SHA512 fdd2b54be8c29565a66439227f83941820339dc3c76fd0dd52393b6e10ee36742fe575566e817db8d90d70ac41b990e848ea2f132b4c581b29bade5d235f904e
SSDEEP 1536:VoOjKUMbTt7BRUZdqeF0y1ISccfXdasWjcdM43:1jqbZ7Twq8PdFM43
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/904-54-0x0000000076531000-0x0000000076533000-memory.dmp

Download

memory/1620-69-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1620-70-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1620-64-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1620-71-0x0000000074530000-0x0000000074ADB000-memory.dmp

Download