snakekeylogger | 9ef7510483c0f6f2ca9a23a39beaaece6b6cab2ff9ec99e90ee6248dd7918287

General

Target

Ticari Hesap Özetiniz.exe
Size

516KB
MD5

7556a8289a0e209e6733873097596c6a
SHA1

0e215e9f459dc253a7f4d6e12b6340a3fe614fa2
SHA256

9ef7510483c0f6f2ca9a23a39beaaece6b6cab2ff9ec99e90ee6248dd7918287
SHA512

6720f4a5d5030972df2eb0e903fd067435bbc234ceaa0f400cde9aabd2e7ab551e917d75560108ee0ab88a8e9ebf369b3e73155ad75a2f0a7c1799d2c5afab0c
SSDEEP

12288:lWO+xpbKbfhvaaZbGw7gGpWupsn2SnrtcW0olM5fo1zujQ:lWTbKNaaZCIvpWua2SrtcW0oW5AJg

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.abraher.com
Port:
587
Username:
[email protected]
Password:
General1
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1540-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1540-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1540-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1540-67-0x000000000042022E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1540-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1540-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Ticari Hesap Özetiniz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ticari Hesap Özetiniz.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ticari Hesap Özetiniz.exe
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ticari Hesap Özetiniz.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ticari Hesap Özetiniz.exe

description pid process target process

PID 2012 set thread context of 1540 2012 Ticari Hesap Özetiniz.exe Ticari Hesap Özetiniz.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Ticari Hesap Özetiniz.exeTicari Hesap Özetiniz.exe

pid process

2012 Ticari Hesap Özetiniz.exe
2012 Ticari Hesap Özetiniz.exe
1540 Ticari Hesap Özetiniz.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Ticari Hesap Özetiniz.exeTicari Hesap Özetiniz.exe

description pid process

Token: SeDebugPrivilege 2012 Ticari Hesap Özetiniz.exe
Token: SeDebugPrivilege 1540 Ticari Hesap Özetiniz.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 2012 set thread context of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe

pid	process
2012	Ticari Hesap Özetiniz.exe
2012	Ticari Hesap Özetiniz.exe
1540	Ticari Hesap Özetiniz.exe

description	pid	process
Token: SeDebugPrivilege	2012	Ticari Hesap Özetiniz.exe
Token: SeDebugPrivilege	1540	Ticari Hesap Özetiniz.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Ticari Hesap Özetiniz.exe

description	pid	process	target process
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe
PID 2012 wrote to memory of 1540	2012	Ticari Hesap Özetiniz.exe	Ticari Hesap Özetiniz.exe

outlook_office_path 1 IoCs

Processes:

Ticari Hesap Özetiniz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ticari Hesap Özetiniz.exe

outlook_win_path 1 IoCs

Processes:

Ticari Hesap Özetiniz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ticari Hesap Özetiniz.exe

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe
"C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe
"C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1540-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1540-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1540-71-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1540-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1540-67-0x000000000042022E-mapping.dmp

Download
memory/1540-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1540-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1540-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2012-55-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/2012-54-0x0000000000F10000-0x0000000000F96000-memory.dmp

Filesize
536KB

Download
memory/2012-59-0x0000000005250000-0x0000000005276000-memory.dmp

Filesize
152KB

Download
memory/2012-58-0x0000000004DE0000-0x0000000004E40000-memory.dmp

Filesize
384KB

Download
memory/2012-57-0x00000000004D0000-0x00000000004DE000-memory.dmp

Filesize
56KB

Download
memory/2012-56-0x00000000004B0000-0x00000000004C6000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads