snakekeylogger | 261f0d52f46daeb7c9f3a5cdfeb16eff3bd590b7bf87a38a5bbd8c2b390bab88

General

Target
new invoice.exe
Size 774KB
Sample221019-pl7ggsfeb8
SHA256 261f0d52f46daeb7c9f3a5cdfeb16eff3bd590b7bf87a38a5bbd8c2b390bab88
MD5 0d4a71300eab7d8badb3112d54f3cbdf
SHA1 c33599dfd4e06588c27697d137029815fad933b6
SHA512 04e64a874a19e3a328072c76b5a2a8fdca74106252c8abde945ab64ba9fc262f38970bccda6d9d8e387aecfe55ec7f31677ac5311504a10e292736798e1b23dc
SSDEEP 12288:e1I22F+0wA7C+70pKXQlU4hM2UKG1rMYmmbm9EFGlNjMV6SYYFb:qI22F+nnXO9glRMV6SYY9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5495243543:AAG3XPeGW7yqfXF6_EXjGSfO9SWHJTpqVsU/sendMessage?chat_id=1128973051

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4956-141-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	new invoice.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 4956	2396	new invoice.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2396	new invoice.exe
2396	new invoice.exe
2396	new invoice.exe
4956	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	new invoice.exe
Token: SeDebugPrivilege	4956	RegSvcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	new invoice.exe
2396	new invoice.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 3808	2396	new invoice.exe	90
PID 2396 wrote to memory of 3808	2396	new invoice.exe	90
PID 2396 wrote to memory of 3808	2396	new invoice.exe	90
PID 2396 wrote to memory of 3760	2396	new invoice.exe	92
PID 2396 wrote to memory of 3760	2396	new invoice.exe	92
PID 2396 wrote to memory of 3760	2396	new invoice.exe	92
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93
PID 2396 wrote to memory of 4956	2396	new invoice.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\new invoice.exe
"C:\Users\Admin\AppData\Local\Temp\new invoice.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CBTINGIXoeDI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp42E5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:3760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp42E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp42E5.tmp
Size 1KB
SHA256 d2b72c725f92d7962bfda8d30d56e53a09059b44ea46f050826eb43153d4e169
MD5 696d8089987624b0faa9ebc8ae0f1630
SHA1 0cf8bd347c68388c20645b10d1a2ed8e3bccda04
SHA512 f53feff5510294ac8c900811531f723288a292cf1a7987f8e2d12dca07e3e576a23010e1fb44e9f94512f9f734a016eeef1c60bb1c6ebd45d374af30b4bb01cb
MD5 SHA1 SHA512

Submit Download

memory/2396-132-0x0000000000360000-0x0000000000428000-memory.dmp

Download

memory/2396-133-0x0000000005380000-0x0000000005924000-memory.dmp

Download

memory/2396-134-0x0000000004DD0000-0x0000000004E62000-memory.dmp

Download

memory/2396-135-0x0000000004F10000-0x0000000004FAC000-memory.dmp

Download

memory/2396-136-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Download

memory/4956-141-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4956-142-0x0000000006830000-0x00000000069F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads