snakekeylogger | 6fccc54b1735e68508ccfdad83f18a26226257c153b714d8cff7d0cffe905423

General

Target

PRICE OFFER_01321.exe
Size

699KB
MD5

c4e2b85e0285bd6fc888c326a4724ba8
SHA1

27629d34786f67e20c31e4ab3ee88276fc8e51a4
SHA256

6fccc54b1735e68508ccfdad83f18a26226257c153b714d8cff7d0cffe905423
SHA512

3038e1a9242a7a94acb083aee37b1d874682181f01cc63b029146b709555c269d3e93fabd40ce22fa2cdb9f65e45be3540646991408ee13ecf6e2f74855b075e

Score

10^/10

snakekeylogger collection evasion keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.anatolia-mountains.com
Port:
587
Username:
h.alhaj@anatolia-mountains.com
Password:
Anatolia3?
Email To:
jevi.jrk@gmail.com

C2

https://api.telegram.org/bot5340115384:AAFLNLUoDjoCsDoiMMlkY81rG-_Kb9LOEBc/sendMessage?chat_id=5316464344

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/584-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/584-72-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/584-74-0x000000000042024E-mapping.dmp	family_snakekeylogger
behavioral1/memory/584-73-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/584-76-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/584-78-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

PRICE OFFER_01321.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions PRICE OFFER_01321.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

PRICE OFFER_01321.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools PRICE OFFER_01321.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	PRICE OFFER_01321.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	PRICE OFFER_01321.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PRICE OFFER_01321.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	PRICE OFFER_01321.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	PRICE OFFER_01321.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

PRICE OFFER_01321.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PRICE OFFER_01321.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PRICE OFFER_01321.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PRICE OFFER_01321.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

PRICE OFFER_01321.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	PRICE OFFER_01321.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	PRICE OFFER_01321.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

PRICE OFFER_01321.exe

description pid process target process

PID 1672 set thread context of 584 1672 PRICE OFFER_01321.exe PRICE OFFER_01321.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1428 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

PRICE OFFER_01321.exepowershell.exepowershell.exePRICE OFFER_01321.exe

pid process

1672 PRICE OFFER_01321.exe
1376 powershell.exe
1716 powershell.exe
1672 PRICE OFFER_01321.exe
584 PRICE OFFER_01321.exe

description	pid	process	target process
PID 1672 set thread context of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe

pid	process
1428	schtasks.exe

pid	process
1672	PRICE OFFER_01321.exe
1376	powershell.exe
1716	powershell.exe
1672	PRICE OFFER_01321.exe
584	PRICE OFFER_01321.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

PRICE OFFER_01321.exepowershell.exepowershell.exePRICE OFFER_01321.exe

description	pid	process
Token: SeDebugPrivilege	1672	PRICE OFFER_01321.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	584	PRICE OFFER_01321.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

PRICE OFFER_01321.exe

description	pid	process	target process
PID 1672 wrote to memory of 1376	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1376	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1376	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1376	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1716	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1716	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1716	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1716	1672	PRICE OFFER_01321.exe	powershell.exe
PID 1672 wrote to memory of 1428	1672	PRICE OFFER_01321.exe	schtasks.exe
PID 1672 wrote to memory of 1428	1672	PRICE OFFER_01321.exe	schtasks.exe
PID 1672 wrote to memory of 1428	1672	PRICE OFFER_01321.exe	schtasks.exe
PID 1672 wrote to memory of 1428	1672	PRICE OFFER_01321.exe	schtasks.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe
PID 1672 wrote to memory of 584	1672	PRICE OFFER_01321.exe	PRICE OFFER_01321.exe

outlook_office_path 1 IoCs

Processes:

PRICE OFFER_01321.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PRICE OFFER_01321.exe

outlook_win_path 1 IoCs

Processes:

PRICE OFFER_01321.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PRICE OFFER_01321.exe

C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe
"C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NDQkzFEuerWbZz.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NDQkzFEuerWbZz" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD23E.tmp"
2⤵
- Creates scheduled task(s)
PID:1428

C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe
"C:\Users\Admin\AppData\Local\Temp\PRICE OFFER_01321.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD23E.tmp
Filesize
1KB

MD5
a12f1f4d8839eb2b459e028daef5c1b0

SHA1
2c7c124c263c183d96054c74151985a1ba4dc6c5

SHA256
b5278d7f27ca8574e403c0eae879bd60302536486c5b397e178667eca3afacee

SHA512
203f53955ebd03f9aa89cf35168a4d3136995fde637836a62825c7c51ff1d92aa241bc5fc6609ebc550007b181e564c539b2c714e889914313e6f5ec754f194d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
4c0d4fa1890b71acde3b849489b38005

SHA1
f7965767dac5191b088d0913b6ebc425644ad821

SHA256
27e5b70231bdcec76f923a7dd8ebb7c7a682c41cdfea1fb78689ccac6668ef14

SHA512
93b8f2be90d462fab12faef05fe9104c49a7f3c6658c741ea33cf76ae8d4db78efcee29a28d2a903a267b2d1bb925171d0a4dd5ad5765156836b8f78326127b2

Download Submit
memory/584-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/584-78-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/584-76-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/584-73-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/584-74-0x000000000042024E-mapping.dmp

Download
memory/584-72-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/584-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/584-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-59-0x0000000000000000-mapping.dmp

Download
memory/1376-80-0x000000006EF10000-0x000000006F4BB000-memory.dmp

Filesize
5.7MB

Download
memory/1376-83-0x000000006EF10000-0x000000006F4BB000-memory.dmp

Filesize
5.7MB

Download
memory/1428-62-0x0000000000000000-mapping.dmp

Download
memory/1672-66-0x0000000004C80000-0x0000000004CA6000-memory.dmp

Filesize
152KB

Download
memory/1672-54-0x0000000001280000-0x0000000001334000-memory.dmp

Filesize
720KB

Download
memory/1672-58-0x0000000007580000-0x00000000075EA000-memory.dmp

Filesize
424KB

Download
memory/1672-57-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/1672-56-0x00000000002B0000-0x00000000002D0000-memory.dmp

Filesize
128KB

Download
memory/1672-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1716-61-0x0000000000000000-mapping.dmp

Download
memory/1716-81-0x000000006EF10000-0x000000006F4BB000-memory.dmp

Filesize
5.7MB

Download
memory/1716-82-0x000000006EF10000-0x000000006F4BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads