snakekeylogger | b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077

Analysis

max time kernel
55s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
25-11-2022 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
Size

637KB
MD5

aa5e35e6ffba2eae676a098b78bfb93d
SHA1

a661569ff4316565c7b20e957b42f017974010f9
SHA256

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
SHA512

3c7669acc40c470fda3bbe46d4a284d4298de7cf94c5579ccf0fbbaacee019d4cb207c0437df0a1823cfdde37f0f236baa7d25d322de342a17f007bdbfd325a0
SSDEEP

12288:jCgh/PsZ1DX/VDJyJzIFaG7f/6TYs0xdWO9gAlPy5xuf9WY9:jCgh/PhJzOt/yYBfPy5xuf9WY9

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
doDHyw%0
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1464-184-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1464-185-0x000000000042019E-mapping.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 checkip.dyndns.org

flow	ioc
8	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description	pid	process	target process
PID 2508 set thread context of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

pid process

1464 b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description pid process

Token: SeDebugPrivilege 1464 b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

pid	process
1464	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description	pid	process
Token: SeDebugPrivilege	1464	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description	pid	process	target process
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
PID 2508 wrote to memory of 1464	2508	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

outlook_office_path 1 IoCs

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

outlook_win_path 1 IoCs

Processes:

b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe

C:\Users\Admin\AppData\Local\Temp\b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
"C:\Users\Admin\AppData\Local\Temp\b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2508

C:\Users\Admin\AppData\Local\Temp\b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
"C:\Users\Admin\AppData\Local\Temp\b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe.log

Filesize
1KB

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/1464-184-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1464-185-0x000000000042019E-mapping.dmp

Download
memory/1464-186-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/1464-187-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/1464-254-0x00000000067B0000-0x0000000006972000-memory.dmp

Filesize
1.8MB

Download
memory/2508-148-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-121-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-118-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-119-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-120-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-151-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-122-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-123-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-124-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-125-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-152-0x0000000005980000-0x0000000005E7E000-memory.dmp

Filesize
5.0MB

Download
memory/2508-127-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-128-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-129-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-130-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-131-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-132-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-133-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-134-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-135-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-136-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-137-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-138-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-140-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-139-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-141-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-142-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-143-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-144-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-150-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-146-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-147-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-116-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-149-0x0000000000AC0000-0x0000000000B66000-memory.dmp

Filesize
664KB

Download
memory/2508-145-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-117-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-126-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-153-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-154-0x00000000053B0000-0x0000000005442000-memory.dmp

Filesize
584KB

Download
memory/2508-155-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-156-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-157-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-158-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-159-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-160-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-161-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-162-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-163-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-164-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-165-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-166-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-167-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-168-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-169-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-170-0x0000000005380000-0x000000000538A000-memory.dmp

Filesize
40KB

Download
memory/2508-171-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-172-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-173-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-174-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-175-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-176-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-177-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-178-0x00000000054F0000-0x0000000005508000-memory.dmp

Filesize
96KB

Download
memory/2508-179-0x0000000005510000-0x000000000551C000-memory.dmp

Filesize
48KB

Download
memory/2508-180-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-181-0x0000000007AC0000-0x0000000007B20000-memory.dmp

Filesize
384KB

Download
memory/2508-182-0x0000000007BC0000-0x0000000007C5C000-memory.dmp

Filesize
624KB

Download
memory/2508-183-0x0000000007B20000-0x0000000007B46000-memory.dmp

Filesize
152KB

Download
memory/2508-115-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-188-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download