snakekeylogger | 4a0533ec0be699006a52b5bf38bd9e3398344d418539d55643abf915ebc478c1

General

Target

vbc(2).exe
Size

788KB
MD5

8ccc107097b21de8164ecb5905dcf027
SHA1

26437be0cd55e95a009799620b6e56e5ca441bf7
SHA256

4a0533ec0be699006a52b5bf38bd9e3398344d418539d55643abf915ebc478c1
SHA512

21f3bcfc5d119ba1a7a71bc431ec1654ba3a83a19b46ccf3884cdae5d3cb3c3f1618e62d43276a2d2d575d77b11638f7d2c7df2b6b8ee82f9629247def3ff639
SSDEEP

12288:MTPSle+W/paSCuAIXnSo8o7ZbMfb8vJETyUy79FrJzwzkV+XRH:+Ko//pNKIXS+x7eGUC9fM

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
LYSV$*b4
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4152-144-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

vbc(2).exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation vbc(2).exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	vbc(2).exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

vbc(2).exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc(2).exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc(2).exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc(2).exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

34 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc(2).exe

description pid process target process

PID 3564 set thread context of 4152 3564 vbc(2).exe vbc(2).exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1444 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc(2).exevbc(2).exepowershell.exe

pid process

3564 vbc(2).exe
3564 vbc(2).exe
4152 vbc(2).exe
332 powershell.exe
332 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vbc(2).exevbc(2).exepowershell.exe

description pid process

Token: SeDebugPrivilege 3564 vbc(2).exe
Token: SeDebugPrivilege 4152 vbc(2).exe
Token: SeDebugPrivilege 332 powershell.exe

flow	ioc
34	checkip.dyndns.org

description	pid	process	target process
PID 3564 set thread context of 4152	3564	vbc(2).exe	vbc(2).exe

pid	process
1444	schtasks.exe

pid	process
3564	vbc(2).exe
3564	vbc(2).exe
4152	vbc(2).exe
332	powershell.exe
332	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3564	vbc(2).exe
Token: SeDebugPrivilege	4152	vbc(2).exe
Token: SeDebugPrivilege	332	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

vbc(2).exe

description	pid	process	target process
PID 3564 wrote to memory of 332	3564	vbc(2).exe	powershell.exe
PID 3564 wrote to memory of 332	3564	vbc(2).exe	powershell.exe
PID 3564 wrote to memory of 332	3564	vbc(2).exe	powershell.exe
PID 3564 wrote to memory of 1444	3564	vbc(2).exe	schtasks.exe
PID 3564 wrote to memory of 1444	3564	vbc(2).exe	schtasks.exe
PID 3564 wrote to memory of 1444	3564	vbc(2).exe	schtasks.exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe
PID 3564 wrote to memory of 4152	3564	vbc(2).exe	vbc(2).exe

outlook_office_path 1 IoCs

Processes:

vbc(2).exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc(2).exe

outlook_win_path 1 IoCs

Processes:

vbc(2).exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc(2).exe

C:\Users\Admin\AppData\Local\Temp\vbc(2).exe
"C:\Users\Admin\AppData\Local\Temp\vbc(2).exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uBzuaar.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:332

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uBzuaar" /XML "C:\Users\Admin\AppData\Local\Temp\tmp27FA.tmp"
2⤵
- Creates scheduled task(s)
PID:1444

C:\Users\Admin\AppData\Local\Temp\vbc(2).exe
"C:\Users\Admin\AppData\Local\Temp\vbc(2).exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp27FA.tmp
Filesize
1KB

MD5
6d70cfdb36f779329ba538bb55a74f48

SHA1
c315ac6dea5a6a1a0c78b0c5075624ba139890de

SHA256
71ac2b078dca776e6bd66bc35c25588a3535b8979aad0f28ae21fc88e9891818

SHA512
616875bee5aba44aed03f23ea8572d324145cf2b9259cd002d82f7e795609fc9ccf496633917f587d2cbee574c36b1fee7e376193c6057d0a1fc5f92d8e6c954

Download Submit
memory/332-150-0x0000000070F40000-0x0000000070F8C000-memory.dmp

Filesize
304KB

Download
memory/332-152-0x0000000007730000-0x0000000007DAA000-memory.dmp

Filesize
6.5MB

Download
memory/332-146-0x0000000004FB0000-0x0000000005016000-memory.dmp

Filesize
408KB

Download
memory/332-147-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

Filesize
120KB

Download
memory/332-145-0x0000000004F10000-0x0000000004F32000-memory.dmp

Filesize
136KB

Download
memory/332-138-0x0000000000000000-mapping.dmp

Download
memory/332-157-0x0000000007430000-0x000000000744A000-memory.dmp

Filesize
104KB

Download
memory/332-140-0x00000000024D0000-0x0000000002506000-memory.dmp

Filesize
216KB

Download
memory/332-156-0x0000000007320000-0x000000000732E000-memory.dmp

Filesize
56KB

Download
memory/332-142-0x00000000050E0000-0x0000000005708000-memory.dmp

Filesize
6.2MB

Download
memory/332-155-0x0000000007370000-0x0000000007406000-memory.dmp

Filesize
600KB

Download
memory/332-154-0x0000000007160000-0x000000000716A000-memory.dmp

Filesize
40KB

Download
memory/332-158-0x0000000007410000-0x0000000007418000-memory.dmp

Filesize
32KB

Download
memory/332-153-0x00000000070F0000-0x000000000710A000-memory.dmp

Filesize
104KB

Download
memory/332-151-0x0000000006370000-0x000000000638E000-memory.dmp

Filesize
120KB

Download
memory/332-149-0x00000000063C0000-0x00000000063F2000-memory.dmp

Filesize
200KB

Download
memory/1444-139-0x0000000000000000-mapping.dmp

Download
memory/3564-132-0x0000000000AB0000-0x0000000000B7C000-memory.dmp

Filesize
816KB

Download
memory/3564-136-0x000000000A300000-0x000000000A39C000-memory.dmp

Filesize
624KB

Download
memory/3564-134-0x00000000078A0000-0x0000000007932000-memory.dmp

Filesize
584KB

Download
memory/3564-135-0x0000000007950000-0x000000000795A000-memory.dmp

Filesize
40KB

Download
memory/3564-133-0x0000000007D70000-0x0000000008314000-memory.dmp

Filesize
5.6MB

Download
memory/3564-137-0x000000000A710000-0x000000000A776000-memory.dmp

Filesize
408KB

Download
memory/4152-148-0x0000000006CC0000-0x0000000006E82000-memory.dmp

Filesize
1.8MB

Download
memory/4152-144-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4152-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads