snakekeylogger | 5ca1451c5426fb3bb6e4394f5e52ee6651683e78aba996da2afd7c4077c8bd9b

General

Target

Purchase Order.js
Size

543KB
MD5

7455e47fd3e5f66fc5b6e1807ea0b568
SHA1

f4b3b59f3bc167f56fcf252f725a2b27d40a9de6
SHA256

5ca1451c5426fb3bb6e4394f5e52ee6651683e78aba996da2afd7c4077c8bd9b
SHA512

8488b277dcac7f1e3cc40b3fe292cf07bdbe441ea695afef5d594442bb6529eee40236b977e739613fd993a03d51038328dbe10dfb1958fe0586491f1209bda3

Score

10^/10

snakekeylogger vjw0rm collection keylogger persistence spyware stealer trojan worm

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5391573401:AAGU5n0aN7puxUq5oVT1MVi83gk5owTXei0/sendMessage?chat_id=1962160861

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Tempwinlogon.exe	family_snakekeylogger
C:\Users\Admin\AppData\Local\Tempwinlogon.exe	family_snakekeylogger
behavioral1/memory/1152-64-0x0000000000D30000-0x0000000000D54000-memory.dmp	family_snakekeylogger

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 16 IoCs

Processes:

wscript.exe

flow	pid	process
5	2036	wscript.exe
8	2036	wscript.exe
9	2036	wscript.exe
11	2036	wscript.exe
13	2036	wscript.exe
14	2036	wscript.exe
16	2036	wscript.exe
17	2036	wscript.exe
18	2036	wscript.exe
20	2036	wscript.exe
21	2036	wscript.exe
22	2036	wscript.exe
24	2036	wscript.exe
25	2036	wscript.exe
26	2036	wscript.exe
28	2036	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

Tempwinlogon.exe

pid process

1152 Tempwinlogon.exe

pid	process
1152	Tempwinlogon.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FuJoSGMkge.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FuJoSGMkge.js	wscript.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Tempwinlogon.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\FuJoSGMkge.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 checkip.dyndns.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Tempwinlogon.exe

pid process

1152 Tempwinlogon.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Tempwinlogon.exe

description pid process

Token: SeDebugPrivilege 1152 Tempwinlogon.exe

flow	ioc
6	checkip.dyndns.org

pid	process
1152	Tempwinlogon.exe

description	pid	process
Token: SeDebugPrivilege	1152	Tempwinlogon.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

wscript.exewscript.exe

description	pid	process	target process
PID 1740 wrote to memory of 2036	1740	wscript.exe	wscript.exe
PID 1740 wrote to memory of 2036	1740	wscript.exe	wscript.exe
PID 1740 wrote to memory of 2036	1740	wscript.exe	wscript.exe
PID 1740 wrote to memory of 2004	1740	wscript.exe	wscript.exe
PID 1740 wrote to memory of 2004	1740	wscript.exe	wscript.exe
PID 1740 wrote to memory of 2004	1740	wscript.exe	wscript.exe
PID 2004 wrote to memory of 1152	2004	wscript.exe	Tempwinlogon.exe
PID 2004 wrote to memory of 1152	2004	wscript.exe	Tempwinlogon.exe
PID 2004 wrote to memory of 1152	2004	wscript.exe	Tempwinlogon.exe
PID 2004 wrote to memory of 1152	2004	wscript.exe	Tempwinlogon.exe

outlook_office_path 1 IoCs

Processes:

Tempwinlogon.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe

outlook_win_path 1 IoCs

Processes:

Tempwinlogon.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Purchase Order.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\FuJoSGMkge.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:2036

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Tamba.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Users\Admin\AppData\Local\Tempwinlogon.exe
"C:\Users\Admin\AppData\Local\Tempwinlogon.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tamba.vbs

Filesize
251KB

MD5
4eb2e71f5af75446efae80ee4457ac16

SHA1
22f002cee2b80eef7a4fbe5daa596a6eca5056a2

SHA256
82c959dc9c7960278bf6094af37d6fff0387602769202afd496c97835c91c8af

SHA512
b1fb12b37ebef5b5955bc932b8bc5f3428d64f8278056a4f4a6569ac2d1716fa0498b69536623914a1d8a3591dc5cf374501c1eff94095975abfaad73d01c984

Download Submit
C:\Users\Admin\AppData\Local\Tempwinlogon.exe

Filesize
125KB

MD5
8855fe5a81d674f17f378896eb0effc1

SHA1
e27c1b5b9f21501cd889c960b16c0951f3204aca

SHA256
f11b2c02ce17039f849429b4904c2ec75ad1c6a0b7204c42238df6ae587b4be4

SHA512
c3ca4ee469ed41b2f8ab4075fc17f462041fe533dfa175b3c48fd907d6dd0feb5a35657f8780479c5e5498e094ae5b14d31f61fd6a9294b8cae3fc035b996e39

Download Submit
C:\Users\Admin\AppData\Local\Tempwinlogon.exe

Filesize
125KB

MD5
8855fe5a81d674f17f378896eb0effc1

SHA1
e27c1b5b9f21501cd889c960b16c0951f3204aca

SHA256
f11b2c02ce17039f849429b4904c2ec75ad1c6a0b7204c42238df6ae587b4be4

SHA512
c3ca4ee469ed41b2f8ab4075fc17f462041fe533dfa175b3c48fd907d6dd0feb5a35657f8780479c5e5498e094ae5b14d31f61fd6a9294b8cae3fc035b996e39

Download Submit
C:\Users\Admin\AppData\Roaming\FuJoSGMkge.js

Filesize
35KB

MD5
afe01f4709bcc51afd50354eaeb32a15

SHA1
4bdc7ccc0337f68c7a74661c774f9a2fd4c3a19e

SHA256
bd47423ced848fab516ff3d230d35a82a82b17d748bd489e1f25e587e90bbb92

SHA512
4d810584b54860361c201327a276d8734fbfcebe64ee42b083b8819067093f25a64aa85991a86b5957496b58b68271a22f12bdd3c11f01b05e11229b08f5417f

Download Submit
memory/1152-61-0x0000000000000000-mapping.dmp

Download
memory/1152-64-0x0000000000D30000-0x0000000000D54000-memory.dmp

Filesize
144KB

Download
memory/1152-65-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1740-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/2004-57-0x0000000000000000-mapping.dmp

Download
memory/2036-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads