snakekeylogger | 57880d7e6823f9f978c7bf24260a35e8e62eaca02ba5d07832257529e9707b3c

General

Target

Po.0087654112.exe
Size

769KB
MD5

e16a257a2e79f06962e2946545b57967
SHA1

9bde3b985a877e21832497d48442012ea31471ff
SHA256

57880d7e6823f9f978c7bf24260a35e8e62eaca02ba5d07832257529e9707b3c
SHA512

8b1a20a4e82ff91b5ee8964189d21dad23836fa3c39d21b6036d84f1a620b7e5b2420e27604063a1a9d2fde74f55c86236f7ae1e233b9d3aa73963c163513a87

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.gaoyang-county-ycm.com
Port:
26
Username:
info@gaoyang-county-ycm.com
Password:
nb34m5bf
Email To:
info@gaoyang-county-ycm.com

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1524-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1524-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1524-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1524-68-0x00000000004201DE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1524-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1524-72-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Po.0087654112.exe

description pid process target process

PID 1080 set thread context of 1524 1080 Po.0087654112.exe Po.0087654112.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 1524 WerFault.exe Po.0087654112.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1560 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Po.0087654112.exePo.0087654112.exe

pid process

1080 Po.0087654112.exe
1080 Po.0087654112.exe
1524 Po.0087654112.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Po.0087654112.exePo.0087654112.exe

description pid process

Token: SeDebugPrivilege 1080 Po.0087654112.exe
Token: SeDebugPrivilege 1524 Po.0087654112.exe

flow	ioc
3	checkip.dyndns.org

description	pid	process	target process
PID 1080 set thread context of 1524	1080	Po.0087654112.exe	Po.0087654112.exe

pid	pid_target	process	target process
836	1524	WerFault.exe	Po.0087654112.exe

pid	process
1560	schtasks.exe

pid	process
1080	Po.0087654112.exe
1080	Po.0087654112.exe
1524	Po.0087654112.exe

description	pid	process
Token: SeDebugPrivilege	1080	Po.0087654112.exe
Token: SeDebugPrivilege	1524	Po.0087654112.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Po.0087654112.exePo.0087654112.exe

description	pid	process	target process
PID 1080 wrote to memory of 1560	1080	Po.0087654112.exe	schtasks.exe
PID 1080 wrote to memory of 1560	1080	Po.0087654112.exe	schtasks.exe
PID 1080 wrote to memory of 1560	1080	Po.0087654112.exe	schtasks.exe
PID 1080 wrote to memory of 1560	1080	Po.0087654112.exe	schtasks.exe
PID 1080 wrote to memory of 1780	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1780	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1780	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1780	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1080 wrote to memory of 1524	1080	Po.0087654112.exe	Po.0087654112.exe
PID 1524 wrote to memory of 836	1524	Po.0087654112.exe	WerFault.exe
PID 1524 wrote to memory of 836	1524	Po.0087654112.exe	WerFault.exe
PID 1524 wrote to memory of 836	1524	Po.0087654112.exe	WerFault.exe
PID 1524 wrote to memory of 836	1524	Po.0087654112.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Po.0087654112.exe
"C:\Users\Admin\AppData\Local\Temp\Po.0087654112.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZmHwuImHCPi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7E93.tmp"
2⤵
- Creates scheduled task(s)
PID:1560

C:\Users\Admin\AppData\Local\Temp\Po.0087654112.exe
"{path}"
2⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\Po.0087654112.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 1100
3⤵
- Program crash
PID:836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7E93.tmp
Filesize
1KB

MD5
dec559547b3ea601e684368e40b1eaa0

SHA1
9485b96d4c86a7bb9d03a85b3340f094752e7523

SHA256
a2699455636652393741f25a137041a4a5cd62aaa5125946ae071a08d2996a43

SHA512
59f10fad6d92f4963bce0440f9b3b5afce37c172c76e837fa112694bfe324adee538a3482f8a464783fb267e83abcd5b4ba41cf9e0c8c0012a8513cac29a487b

Download Submit
memory/836-74-0x0000000000000000-mapping.dmp

Download
memory/1080-54-0x0000000000A60000-0x0000000000B26000-memory.dmp

Filesize
792KB

Download
memory/1080-55-0x00000000752D1000-0x00000000752D3000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/1080-57-0x0000000004800000-0x0000000004872000-memory.dmp

Filesize
456KB

Download
memory/1080-58-0x00000000020C0000-0x00000000020E6000-memory.dmp

Filesize
152KB

Download
memory/1524-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1524-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1524-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1524-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1524-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1524-68-0x00000000004201DE-mapping.dmp

Download
memory/1524-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1524-72-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1560-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads