snakekeylogger | 0e1727e8db89ee82bc788703a6ea9304b3c8db4585abaa17be4d3f99ac6f7c93

General

Target

gregzx.exe
Size

699KB
MD5

b5211b4f224d8b9e5b43a09a9d99840a
SHA1

29ca332c5f512d8767251d2e707e36ae41476a56
SHA256

0e1727e8db89ee82bc788703a6ea9304b3c8db4585abaa17be4d3f99ac6f7c93
SHA512

1dafc1e88ef2e21fb33e30f01fc30d5aebc821d97a3719a2455b25d3720c1ea08346b95f99acf6b9752459607936cde44c415004af38f53ad4da49f3aa3084f8

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
samsung-tv.buzz
Port:
587
Username:
greglog@samsung-tv.buzz
Password:
7213575aceACE@#$
Email To:
greg@samsung-tv.buzz

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2772-137-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

gregzx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gregzx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gregzx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gregzx.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

gregzx.exe

description pid process target process

PID 3328 set thread context of 2772 3328 gregzx.exe gregzx.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

gregzx.exe

pid process

2772 gregzx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

gregzx.exe

description pid process

Token: SeDebugPrivilege 2772 gregzx.exe

flow	ioc
38	checkip.dyndns.org

description	pid	process	target process
PID 3328 set thread context of 2772	3328	gregzx.exe	gregzx.exe

pid	process
2772	gregzx.exe

description	pid	process
Token: SeDebugPrivilege	2772	gregzx.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

gregzx.exe

description	pid	process	target process
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe
PID 3328 wrote to memory of 2772	3328	gregzx.exe	gregzx.exe

outlook_office_path 1 IoCs

Processes:

gregzx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gregzx.exe

outlook_win_path 1 IoCs

Processes:

gregzx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	gregzx.exe

C:\Users\Admin\AppData\Local\Temp\gregzx.exe
"C:\Users\Admin\AppData\Local\Temp\gregzx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328

C:\Users\Admin\AppData\Local\Temp\gregzx.exe
"C:\Users\Admin\AppData\Local\Temp\gregzx.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gregzx.exe.log
Filesize
1KB

MD5
5a54330a46b8ad20456912329c140a8e

SHA1
854974c1d6a0ec593d9b81ef84be7fe6e410147b

SHA256
a0bf868878249ff926c2b8272ac16f7d86bd62461e8fa45d3379cb191bf1a277

SHA512
ab6788d52dfbea7c8c891dcfee6dbdc4acbf50f19ac2dcc8f1b315161b217113e6c7cc283cf6cf9546704657556e1d640743396dc056601ca04a1aef3be4f720

Download Submit
memory/2772-136-0x0000000000000000-mapping.dmp

Download
memory/2772-137-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2772-139-0x0000000006670000-0x0000000006832000-memory.dmp

Filesize
1.8MB

Download
memory/3328-130-0x00000000002F0000-0x00000000003A6000-memory.dmp

Filesize
728KB

Download
memory/3328-131-0x0000000005550000-0x0000000005AF4000-memory.dmp

Filesize
5.6MB

Download
memory/3328-132-0x0000000005040000-0x00000000050D2000-memory.dmp

Filesize
584KB

Download
memory/3328-133-0x0000000005B00000-0x0000000005B9C000-memory.dmp

Filesize
624KB

Download
memory/3328-134-0x00000000054F0000-0x00000000054FA000-memory.dmp

Filesize
40KB

Download
memory/3328-135-0x0000000009110000-0x0000000009176000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads