snakekeylogger | 4fdbb565cacf8d38c63c42c2afeaaf59e6b5bf226709cde754219c96fee3aff9

General

Target
m9RGZGWavSniRdK.exe
Size 788KB
Sample220914-wfp4ksefgn
SHA256 4fdbb565cacf8d38c63c42c2afeaaf59e6b5bf226709cde754219c96fee3aff9
MD5 deeb0687eff91c877f15af6fe87b52f9
SHA1 6ba3166231d864a67ec024e2734658aa832bb6e9
SHA512 70ca715dc012412f95391e09316de4ea8c44bda3e566d14564437feafc6f4da04fbffe065efa96caa7428a81ee6ae172d6b734983eaaf2c28c56dcc2414c3327
SSDEEP 12288:NhlylSx18ydmmzV3MT6bL+EiNxsRSYHEQADqjJ5nyhZHlc/ZP26eixPPNaJVRbLi:78AmmSTIdiHsRTjryY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection evasion keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.bestelectricpanels.com
Port
25
Username
[email protected]
Password
ahsan3863232
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/3268-139-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	m9RGZGWavSniRdK.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	m9RGZGWavSniRdK.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	m9RGZGWavSniRdK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	m9RGZGWavSniRdK.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	checkip.dyndns.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	m9RGZGWavSniRdK.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	m9RGZGWavSniRdK.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 3268	632	m9RGZGWavSniRdK.exe	90

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3268	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90
PID 632 wrote to memory of 3268	632	m9RGZGWavSniRdK.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\m9RGZGWavSniRdK.exe
"C:\Users\Admin\AppData\Local\Temp\m9RGZGWavSniRdK.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3268