snakekeylogger | 9d4faa17adb02b020e7d9d7807a84ccb4e9285eb05f5cbae9ba7ee1e07d7b52a

Analysis

max time kernel
42s
max time network
112s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 09:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
purchase list.exe
Size 296KB
Sample221121-kz2e6scd39
SHA256 9d4faa17adb02b020e7d9d7807a84ccb4e9285eb05f5cbae9ba7ee1e07d7b52a
MD5 3fa61f83252009dabcc552664e260c19
SHA1 dce10946b46c9e2ce95f66aee60b8e1a5dbf1b25
SHA512 c8e9b55e13222be0830081744a98d8c8d2e22a5f0fcdb5feb3eef6c8a55195a66542b9ee4289aa3c452036b1174838a9887376ecf10462dce62c0e89f00dbfcb
SSDEEP 6144:jEa0z1fOaO71NNsdHxlBmtoCbPS4UKP5Ot+/5/DI27UYYn:Wfs1N4RRCbPS4hP5OtY5/DI2U/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger persistence spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

resource	yara_rule
behavioral1/memory/520-66-0x0000000000480000-0x00000000004A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/520-67-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1008	nvylagw.exe
520	nvylagw.exe

Loads dropped DLL 2 IoCs

pid	Process
1764	purchase list.exe
1008	nvylagw.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nvylagw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nvylagw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nvylagw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\jejbi = "C:\\Users\\Admin\\AppData\\Roaming\\medgklh\\uvxqlyfyemebcb.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\nvylagw.exe\" C:\\Users\\Admin\\AppData\\L"	nvylagw.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 520	1008	nvylagw.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
520	nvylagw.exe
520	nvylagw.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1008	nvylagw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	520	nvylagw.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1008	1764	purchase list.exe	28
PID 1764 wrote to memory of 1008	1764	purchase list.exe	28
PID 1764 wrote to memory of 1008	1764	purchase list.exe	28
PID 1764 wrote to memory of 1008	1764	purchase list.exe	28
PID 1008 wrote to memory of 520	1008	nvylagw.exe	29
PID 1008 wrote to memory of 520	1008	nvylagw.exe	29
PID 1008 wrote to memory of 520	1008	nvylagw.exe	29
PID 1008 wrote to memory of 520	1008	nvylagw.exe	29
PID 1008 wrote to memory of 520	1008	nvylagw.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nvylagw.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nvylagw.exe

C:\Users\Admin\AppData\Local\Temp\purchase list.exe
"C:\Users\Admin\AppData\Local\Temp\purchase list.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\AppData\Local\Temp\nvylagw.exe
  "C:\Users\Admin\AppData\Local\Temp\nvylagw.exe" C:\Users\Admin\AppData\Local\Temp\pizvkqrpi.p
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Local\Temp\nvylagw.exe
    "C:\Users\Admin\AppData\Local\Temp\nvylagw.exe" C:\Users\Admin\AppData\Local\Temp\pizvkqrpi.p
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nvylagw.exe

Path C:\Users\Admin\AppData\Local\Temp\nvylagw.exe
Size 92KB
SHA256 b91e3abfafaf8dc7dfb94a7bfdf45ac83e06a0e83fbd35ae02f29c3ecbf18b99
MD5 188db87825d1ba7b76d53fc8df5bd2db
SHA1 75ae3cb01c3aafb0e44ed618308c5466522cea9f
SHA512 8e1cb9ec5ec969fdfcc5775224c871fa3efb177fbce793316d203624e7c2e5f73c4df4f804060758ab6411a1f0c1ecab1bd8592385251e5530a364598ab8a8dd
SSDEEP 1536:XRGIuMv+hWrqnnbaN73ovSijPMEGmQCDxEMxi4NJr6073Wjo3LPVW34msWZcd0al:BB4bG73WzhDSMxi70Cjo3LP434/0aIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvylagw.exe

Path C:\Users\Admin\AppData\Local\Temp\nvylagw.exe
Size 92KB
SHA256 b91e3abfafaf8dc7dfb94a7bfdf45ac83e06a0e83fbd35ae02f29c3ecbf18b99
MD5 188db87825d1ba7b76d53fc8df5bd2db
SHA1 75ae3cb01c3aafb0e44ed618308c5466522cea9f
SHA512 8e1cb9ec5ec969fdfcc5775224c871fa3efb177fbce793316d203624e7c2e5f73c4df4f804060758ab6411a1f0c1ecab1bd8592385251e5530a364598ab8a8dd
SSDEEP 1536:XRGIuMv+hWrqnnbaN73ovSijPMEGmQCDxEMxi4NJr6073Wjo3LPVW34msWZcd0al:BB4bG73WzhDSMxi70Cjo3LP434/0aIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvylagw.exe

Path C:\Users\Admin\AppData\Local\Temp\nvylagw.exe
Size 92KB
SHA256 b91e3abfafaf8dc7dfb94a7bfdf45ac83e06a0e83fbd35ae02f29c3ecbf18b99
MD5 188db87825d1ba7b76d53fc8df5bd2db
SHA1 75ae3cb01c3aafb0e44ed618308c5466522cea9f
SHA512 8e1cb9ec5ec969fdfcc5775224c871fa3efb177fbce793316d203624e7c2e5f73c4df4f804060758ab6411a1f0c1ecab1bd8592385251e5530a364598ab8a8dd
SSDEEP 1536:XRGIuMv+hWrqnnbaN73ovSijPMEGmQCDxEMxi4NJr6073Wjo3LPVW34msWZcd0al:BB4bG73WzhDSMxi70Cjo3LP434/0aIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

pizvkqrpi.p

Path C:\Users\Admin\AppData\Local\Temp\pizvkqrpi.p
Size 7KB
SHA256 35fccdd1cc03e0c1454535601b83a48c44bf3d02c730ab4ee683a5425fecbd5e
MD5 8f1653c9e093f416bebc9fa90e8c06e0
SHA1 a5155a8d7aca9ecb0650dfa560c899e90ee2c4d3
SHA512 ed04e56906ea79fe5bfe852f5fde418d9053387553aec0a4639734067c601afd7678f138d59c58096fb66cd665d4a52be4eb281ffcb75c433bfe652ab6048592
SSDEEP 192:BKQdyo6Or9dj6k+ebVcxqi6+JYuLKlnZo45:Ndy6L6qVGqJ+bLsZo45
MD5 SHA1 SHA512 SSDEEP

Submit Download

xisbz.ds

Path C:\Users\Admin\AppData\Local\Temp\xisbz.ds
Size 205KB
SHA256 3022794c65928ea7b11fb10591749ed74e6aa6ec3c18a989e0213120830283af
MD5 55e1715e285adafef20811bf7dca3557
SHA1 ef708bb1111065086b5ae19e0b6ae1bfebfeba55
SHA512 ef08d81921039d5d1a894449f840694b4876a0cb3f05801805c9996207b00b933e7f1b0864917c241afdef7968d3d29682d10ed17563611dac6fc3441569456b
SSDEEP 6144:CKL0Ots0D1m7CdGa0S1boXbtRXIGPKC8vzDQED:CM0O91O8Gm1MLtFIGPKCQzDQED
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvylagw.exe

Path \Users\Admin\AppData\Local\Temp\nvylagw.exe
Size 92KB
SHA256 b91e3abfafaf8dc7dfb94a7bfdf45ac83e06a0e83fbd35ae02f29c3ecbf18b99
MD5 188db87825d1ba7b76d53fc8df5bd2db
SHA1 75ae3cb01c3aafb0e44ed618308c5466522cea9f
SHA512 8e1cb9ec5ec969fdfcc5775224c871fa3efb177fbce793316d203624e7c2e5f73c4df4f804060758ab6411a1f0c1ecab1bd8592385251e5530a364598ab8a8dd
SSDEEP 1536:XRGIuMv+hWrqnnbaN73ovSijPMEGmQCDxEMxi4NJr6073Wjo3LPVW34msWZcd0al:BB4bG73WzhDSMxi70Cjo3LP434/0aIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvylagw.exe

Path \Users\Admin\AppData\Local\Temp\nvylagw.exe
Size 92KB
SHA256 b91e3abfafaf8dc7dfb94a7bfdf45ac83e06a0e83fbd35ae02f29c3ecbf18b99
MD5 188db87825d1ba7b76d53fc8df5bd2db
SHA1 75ae3cb01c3aafb0e44ed618308c5466522cea9f
SHA512 8e1cb9ec5ec969fdfcc5775224c871fa3efb177fbce793316d203624e7c2e5f73c4df4f804060758ab6411a1f0c1ecab1bd8592385251e5530a364598ab8a8dd
SSDEEP 1536:XRGIuMv+hWrqnnbaN73ovSijPMEGmQCDxEMxi4NJr6073Wjo3LPVW34msWZcd0al:BB4bG73WzhDSMxi70Cjo3LP434/0aIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/520-66-0x0000000000480000-0x00000000004A6000-memory.dmp

Download

memory/520-67-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1764-54-0x0000000076261000-0x0000000076263000-memory.dmp

Download