snakekeylogger | 11790a90358d5f0be495fce0dc3870ec8c088f23eddc84d4e90d5d4281ea6f27

General

Target
Due payment.exe
Size 550KB
Sample220523-qlm9aaghbk
SHA256 11790a90358d5f0be495fce0dc3870ec8c088f23eddc84d4e90d5d4281ea6f27
MD5 7f5357643719d8f2cab30b9f53dc9782
SHA1 c7a8448337b098d896b9779659da373a5a5014af
SHA512 d60b7bc1c20d786f6be29f0b18bd876627170ced35e96a3b075e5b7af39cd3930a47e7d9b0d29a636080242e86df5e4709f2173c038d51415c03ffeefb4ea902
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
stilltech.ro
Port
587
Username
[email protected]
Password
eurobit555ro
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/116-137-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 116	4984	Due payment.exe	88

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
116	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88
PID 4984 wrote to memory of 116	4984	Due payment.exe	88

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Due payment.exe
"C:\Users\Admin\AppData\Local\Temp\Due payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/116-137-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/116-138-0x0000000006560000-0x0000000006722000-memory.dmp

Download

memory/4984-130-0x0000000000B80000-0x0000000000C0E000-memory.dmp

Download

memory/4984-131-0x0000000005C20000-0x00000000061C4000-memory.dmp

Download

memory/4984-132-0x0000000005580000-0x0000000005612000-memory.dmp

Download

memory/4984-133-0x0000000005630000-0x000000000563A000-memory.dmp

Download

memory/4984-134-0x0000000008E70000-0x0000000008F0C000-memory.dmp

Download

memory/4984-135-0x00000000093D0000-0x0000000009436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads