Overview

overview

10

Static

static

AWB DHL SH...CS.exe

windows7-x64

3

AWB DHL SH...CS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AWB DHL SHIPMENT DOCS.exe

  • Size

    16KB

  • Sample

    220930-qf3f1seedq

  • MD5

    e22a17f2fd4f98c0508f50b6ab8d1948

  • SHA1

    6a185691aa74ed5f769c09faaa59d2f9ec5e04ac

  • SHA256

    5193184cceeb7785142ebd8770280a449fbe811fcbdfa5c7672116e69f8897b6

  • SHA512

    dde9660a4e3b6905833ac914b2ca3a2e400a00363b4dd1c46c2383c3461e1bbde016876f4c390272757ce629f07acbc1d189f98d86b70686c07ae8c65dfd7d89

  • SSDEEP

    192:6Z+wT4vLHkLF5hyfC+M2oA9irN9hJethjFUTUQdIunJvTLq7BbVc2Nk9G74ldV7:6FPLF5hX+wc5ULdIuJ7m7hm2NCyQV

Score
10/10
snakekeyloggercollectionkeyloggerpersistencestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      AWB DHL SHIPMENT DOCS.exe

    • Size

      16KB

    • MD5

      e22a17f2fd4f98c0508f50b6ab8d1948

    • SHA1

      6a185691aa74ed5f769c09faaa59d2f9ec5e04ac

    • SHA256

      5193184cceeb7785142ebd8770280a449fbe811fcbdfa5c7672116e69f8897b6

    • SHA512

      dde9660a4e3b6905833ac914b2ca3a2e400a00363b4dd1c46c2383c3461e1bbde016876f4c390272757ce629f07acbc1d189f98d86b70686c07ae8c65dfd7d89

    • SSDEEP

      192:6Z+wT4vLHkLF5hyfC+M2oA9irN9hJethjFUTUQdIunJvTLq7BbVc2Nk9G74ldV7:6FPLF5hX+wc5ULdIuJ7m7hm2NCyQV

    Score
    10/10
    snakekeyloggercollectionkeyloggerpersistencestealer

    • Modifies WinLogon for persistence

      persistence

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks