snakekeylogger | 2ca7e058ce4e3266229acc9e620c03f78a7b05ae5c3f88f708be44e68e8c80e7

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2022, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
luHzSnIwZ9s5rli.exe
Size 919KB
Sample220826-gpqn5sgcdq
SHA256 2ca7e058ce4e3266229acc9e620c03f78a7b05ae5c3f88f708be44e68e8c80e7
MD5 c221aa52bbc878f9b07cc3ca26b81d0b
SHA1 5ff4e09ae8f7b40baa06bcbdb19ace3de55973c5
SHA512 547697468ccf181dc1f83ad145da66b6686e6908d7773bda813f7ff03e9a29a251cbe218df23c66795e0f18c5d935fca955db7610012219f432370aab4592055
SSDEEP 12288:OI9u7A+ANNhfT/0e5hz9bH2iNPT/0e5hz9bQIi0WTw9ftrsL6VtM5o1bPuekqc14:OI4aZT/0shbH1hT/0shb+0WT8troknk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5122580304:AAHkCWB9EFavZMQfS6pgdGmtEGk1zc21s0Q/sendMessage?chat_id=5138702702

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4760-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
49	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3312 set thread context of 4760	3312	luHzSnIwZ9s5rli.exe	94

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4760	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94
PID 3312 wrote to memory of 4760	3312	luHzSnIwZ9s5rli.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\luHzSnIwZ9s5rli.exe
"C:\Users\Admin\AppData\Local\Temp\luHzSnIwZ9s5rli.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3312-132-0x0000000000FA0000-0x000000000108C000-memory.dmp

Download

memory/3312-133-0x00000000083C0000-0x0000000008964000-memory.dmp

Download

memory/3312-134-0x0000000007F00000-0x0000000007F92000-memory.dmp

Download

memory/3312-135-0x00000000080A0000-0x00000000080AA000-memory.dmp

Download

memory/3312-136-0x0000000005C40000-0x0000000005CDC000-memory.dmp

Download

memory/4760-138-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4760-139-0x0000000006A00000-0x0000000006BC2000-memory.dmp

Download