snakekeylogger | 3a0b6787796ffb3c82882fff1951c0c2fd2925fc5f0d4cd2e92c0d058dfa8c10

General

Target
bank report.exe
Size 860KB
Sample221215-jsn1tsbh43
SHA256 3a0b6787796ffb3c82882fff1951c0c2fd2925fc5f0d4cd2e92c0d058dfa8c10
MD5 6735ccde146fe008263d05a3016b665e
SHA1 ef3dd3211812766427284c9e8d61a51758278969
SHA512 acb3aa1f352e23984e8605bc95bbb0296d981f2900b3f777c853c1866b39f9963e71dba0576f482c0d6d5d16178e36d56e3c86b0e52bbab4398979020dac0175
SSDEEP 24576:SzuPO0vPk92OKEbH1JqAD0P7BywmAqQm:WYPa2OK630ywmA9m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1644755040:AAGRTnph6BdO8-t1bJaOyVu9aeuJErmisqs/sendMessage?chat_id=1637651323

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4620-141-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	bank report.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bank report.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bank report.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bank report.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 4620	2404	bank report.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2404	bank report.exe
2404	bank report.exe
2404	bank report.exe
4620	bank report.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	bank report.exe
Token: SeDebugPrivilege	4620	bank report.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1564	2404	bank report.exe	91
PID 2404 wrote to memory of 1564	2404	bank report.exe	91
PID 2404 wrote to memory of 1564	2404	bank report.exe	91
PID 2404 wrote to memory of 4608	2404	bank report.exe	93
PID 2404 wrote to memory of 4608	2404	bank report.exe	93
PID 2404 wrote to memory of 4608	2404	bank report.exe	93
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94
PID 2404 wrote to memory of 4620	2404	bank report.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bank report.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bank report.exe

C:\Users\Admin\AppData\Local\Temp\bank report.exe
"C:\Users\Admin\AppData\Local\Temp\bank report.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oXvvknPRueU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1443.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1564
- C:\Users\Admin\AppData\Local\Temp\bank report.exe
  "{path}"
  2⤵
  PID:4608
- C:\Users\Admin\AppData\Local\Temp\bank report.exe
  "{path}"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bank report.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bank report.exe.log
Size 1KB
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
MD5 SHA1 SHA512

Submit Download

tmp1443.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1443.tmp
Size 1KB
SHA256 bf9130e876b1b9efa85f293c58f150082b462dbeec0d3c4fd579ee2da583c176
MD5 9dcd76e1928c4eda0e1c2f8dcb9781a1
SHA1 49530ae5161a0e6c3681f5f62fb8bec2a8af62cc
SHA512 d6fab011fd61aacba1ef64c9ab25b6338f511198996bf160049992f2f18f87b51fc963db98632832a03a89d2675a704d7d0602df06535236131413ac92011859
MD5 SHA1 SHA512

Submit Download

memory/2404-132-0x0000000000470000-0x000000000054C000-memory.dmp

Download

memory/2404-133-0x0000000005490000-0x0000000005A34000-memory.dmp

Download

memory/2404-134-0x0000000004F80000-0x0000000005012000-memory.dmp

Download

memory/2404-135-0x0000000005020000-0x00000000050BC000-memory.dmp

Download

memory/2404-136-0x0000000002A80000-0x0000000002A8A000-memory.dmp

Download

memory/4620-141-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4620-143-0x00000000069E0000-0x0000000006BA2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads