snakekeylogger | ac9ca9b2d052e51d3a76119b8a640064eeff1693609e54bb316e2749a319f8e2

General

Target

UPDATED SOA.exe
Size

1001KB
MD5

306860afb2d8aaa535fcbf83fde3d36c
SHA1

e06af2b9c1cdd72a3fd53f15c7809a83c4076f0c
SHA256

c1414c69b3a5c0b020383097fe696a2b6f837657812488db31bed9d1848ee057
SHA512

9f2e1e49b95c4fa5c8bf381ebc34ff6d487d21ae8c7cc3f7bc8ad19e02b7ac6516975a42def01b476807a91d24169ae512a10ac6f05f72c9f03c687d201ef8d6
SSDEEP

12288:CAeY2iNw0+9MKXACOu1vn1AXvDx5qGN35c2s7thlqjJ5nauNmyF3qNm5rXOHyHis:CAJ1Ie6OEvm3J5bs7thwjr

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5227573794:AAECZBnQSxLs0aOVsV2wnclC6-WKnxPpi_k/sendMessage?chat_id=5217421430

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/520-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/520-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/520-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/520-68-0x00000000004202FE-mapping.dmp	family_snakekeylogger
behavioral1/memory/520-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/520-72-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

UPDATED SOA.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	UPDATED SOA.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	UPDATED SOA.exe
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	UPDATED SOA.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

UPDATED SOA.exe

description pid process target process

PID 1064 set thread context of 520 1064 UPDATED SOA.exe UPDATED SOA.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

552 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

UPDATED SOA.exeUPDATED SOA.exe

pid process

1064 UPDATED SOA.exe
520 UPDATED SOA.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

UPDATED SOA.exeUPDATED SOA.exe

description pid process

Token: SeDebugPrivilege 1064 UPDATED SOA.exe
Token: SeDebugPrivilege 520 UPDATED SOA.exe

flow	ioc
3	checkip.dyndns.org

description	pid	process	target process
PID 1064 set thread context of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe

pid	process
552	schtasks.exe

pid	process
1064	UPDATED SOA.exe
520	UPDATED SOA.exe

description	pid	process
Token: SeDebugPrivilege	1064	UPDATED SOA.exe
Token: SeDebugPrivilege	520	UPDATED SOA.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

UPDATED SOA.exe

description	pid	process	target process
PID 1064 wrote to memory of 552	1064	UPDATED SOA.exe	schtasks.exe
PID 1064 wrote to memory of 552	1064	UPDATED SOA.exe	schtasks.exe
PID 1064 wrote to memory of 552	1064	UPDATED SOA.exe	schtasks.exe
PID 1064 wrote to memory of 552	1064	UPDATED SOA.exe	schtasks.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe
PID 1064 wrote to memory of 520	1064	UPDATED SOA.exe	UPDATED SOA.exe

outlook_office_path 1 IoCs

Processes:

UPDATED SOA.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	UPDATED SOA.exe

outlook_win_path 1 IoCs

Processes:

UPDATED SOA.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	UPDATED SOA.exe

C:\Users\Admin\AppData\Local\Temp\UPDATED SOA.exe
"C:\Users\Admin\AppData\Local\Temp\UPDATED SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STARgZTNO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp844D.tmp"
2⤵
- Creates scheduled task(s)
PID:552

C:\Users\Admin\AppData\Local\Temp\UPDATED SOA.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp844D.tmp
Filesize
1KB

MD5
78c4279aec258eb78b08245ed0b5a8b5

SHA1
cb5f89fb8d7cbd9d9924565377d86b1fe0b49cff

SHA256
aa150711ee8350153e17fdfe37d0412c25179511b464800cf543658558801e9b

SHA512
0dcf3e75e9a09dda3d7a91d7b345e8bd1dc89498b446a7ec51b7b5bffca319c2bf481521cfd1b41ab16650e21ac1d19e7baa91a4f196a766e1ed56fd48d73f53

Download Submit
memory/520-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/520-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/520-72-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/520-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/520-68-0x00000000004202FE-mapping.dmp

Download
memory/520-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/520-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/520-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/552-59-0x0000000000000000-mapping.dmp

Download
memory/1064-54-0x0000000000BD0000-0x0000000000CD0000-memory.dmp

Filesize
1024KB

Download
memory/1064-55-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x0000000000870000-0x0000000000890000-memory.dmp

Filesize
128KB

Download
memory/1064-58-0x0000000000910000-0x0000000000936000-memory.dmp

Filesize
152KB

Download
memory/1064-57-0x0000000004EF0000-0x0000000004F66000-memory.dmp

Filesize
472KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads