snakekeylogger | 4ade79259ddc557d6b0abf68de4b5fbe61e532db6eae5b29ef30e3a71bbf17e2

General

Target

SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
Size

514KB
MD5

1dd7da1e3f984e629949dcaec89447e1
SHA1

fb41c0f5106735929a44f8cee8fb65a7bf152d9d
SHA256

4ade79259ddc557d6b0abf68de4b5fbe61e532db6eae5b29ef30e3a71bbf17e2
SHA512

1b44e4544c9f03bc8d677fa37209bd40ebf6b188c1d8703c679886253fb759dcdaf51c32426389b19f32141cecb279ce7d7b106de287bd9863ee5911a641e653
SSDEEP

12288:kmAsXGV66h7Jos3QLmMSh+4deSE+NxM9dDfZH:y/sLkhQ8Nxu

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5542941782:AAFlsn_FCfYT7D_ZthXK_Udd4a15AE58_Wg/sendMessage?chat_id=2054148913

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4072-145-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
4056	powershell.exe
4072	RegSvcs.exe
4056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4072	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 4056	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	92
PID 1692 wrote to memory of 4056	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	92
PID 1692 wrote to memory of 4056	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	92
PID 1692 wrote to memory of 1780	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	94
PID 1692 wrote to memory of 1780	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	94
PID 1692 wrote to memory of 1780	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	94
PID 1692 wrote to memory of 1232	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	96
PID 1692 wrote to memory of 1232	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	96
PID 1692 wrote to memory of 1232	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	96
PID 1692 wrote to memory of 1696	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	97
PID 1692 wrote to memory of 1696	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	97
PID 1692 wrote to memory of 1696	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	97
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98
PID 1692 wrote to memory of 4072	1692	SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe	98

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Barys.51118.16839.28532.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qOyVDDIOgT.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qOyVDDIOgT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DD4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3DD4.tmp

Filesize
1KB

MD5
04a860c7d872cc8f8c2f23ee54171069

SHA1
dbb93177225d7a062a6debd87957696228ebd790

SHA256
964493078cae41b1e7a300ba5458eb0a4bb7a845ceeaf87cbfeb7abb21f63230

SHA512
ba76fd4229caa75a5a34503333f6d892e96bd5d56cbb62f59892aa1d434c4295f6793e3ab6ce7eea8380e1e714be91c544a57a4918861de06741b9aa322654fc

Download Submit
memory/1692-133-0x0000000005810000-0x0000000005DB4000-memory.dmp

Filesize
5.6MB

Download
memory/1692-134-0x00000000051B0000-0x0000000005242000-memory.dmp

Filesize
584KB

Download
memory/1692-135-0x0000000005360000-0x000000000536A000-memory.dmp

Filesize
40KB

Download
memory/1692-136-0x0000000008BB0000-0x0000000008C4C000-memory.dmp

Filesize
624KB

Download
memory/1692-132-0x00000000007A0000-0x0000000000826000-memory.dmp

Filesize
536KB

Download
memory/4056-146-0x00000000056C0000-0x00000000056E2000-memory.dmp

Filesize
136KB

Download
memory/4056-154-0x0000000007ED0000-0x000000000854A000-memory.dmp

Filesize
6.5MB

Download
memory/4056-139-0x0000000002C70000-0x0000000002CA6000-memory.dmp

Filesize
216KB

Download
memory/4056-160-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

Filesize
32KB

Download
memory/4056-159-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Filesize
104KB

Download
memory/4056-147-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/4056-148-0x0000000005F30000-0x0000000005F96000-memory.dmp

Filesize
408KB

Download
memory/4056-149-0x0000000006580000-0x000000000659E000-memory.dmp

Filesize
120KB

Download
memory/4056-158-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

Filesize
56KB

Download
memory/4056-151-0x0000000006B50000-0x0000000006B82000-memory.dmp

Filesize
200KB

Download
memory/4056-152-0x00000000703E0000-0x000000007042C000-memory.dmp

Filesize
304KB

Download
memory/4056-153-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Filesize
120KB

Download
memory/4056-142-0x0000000005810000-0x0000000005E38000-memory.dmp

Filesize
6.2MB

Download
memory/4056-155-0x0000000007880000-0x000000000789A000-memory.dmp

Filesize
104KB

Download
memory/4056-156-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/4056-157-0x0000000007B00000-0x0000000007B96000-memory.dmp

Filesize
600KB

Download
memory/4072-150-0x0000000006360000-0x0000000006522000-memory.dmp

Filesize
1.8MB

Download
memory/4072-145-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads