snakekeylogger | f4baf2d65d70c27d2d9bc0726a867ef595f15428b29e0f8747bb02e2a238a557

Analysis

max time kernel
91s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2022, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payment copy.exe
Size 148KB
Sample221219-qf3rsaab2v
SHA256 f4baf2d65d70c27d2d9bc0726a867ef595f15428b29e0f8747bb02e2a238a557
MD5 fcd1705f5fbfe58d5e8e00c9a1908c4c
SHA1 ed42df2bec6f58413aeb35e993c6d180c4669f0b
SHA512 f55def1b2ce78ccc0152a4cdc1ecae77b9f2aa6f945176f24422e19eb821c8a4faa02a4039514b324a90da346da82adcf497cd262972854d5065cc18c1e96a2a
SSDEEP 3072:rlTSr+vbmJjhOq61U4BdtWhIRl3F5kyV5l7r:rkw8d4BdomRtF5kcvr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger spyware stealer upx

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4724-141-0x0000000000400000-0x000000000043B000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
2204	eppqjs.exe
4724	eppqjs.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4724-141-0x0000000000400000-0x000000000043B000-memory.dmp	upx

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eppqjs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eppqjs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eppqjs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 4724	2204	eppqjs.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	eppqjs.exe
4724	eppqjs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2204	eppqjs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	eppqjs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2204	2220	payment copy.exe	80
PID 2220 wrote to memory of 2204	2220	payment copy.exe	80
PID 2220 wrote to memory of 2204	2220	payment copy.exe	80
PID 2204 wrote to memory of 4724	2204	eppqjs.exe	81
PID 2204 wrote to memory of 4724	2204	eppqjs.exe	81
PID 2204 wrote to memory of 4724	2204	eppqjs.exe	81
PID 2204 wrote to memory of 4724	2204	eppqjs.exe	81
PID 4724 wrote to memory of 5028	4724	eppqjs.exe	82
PID 4724 wrote to memory of 5028	4724	eppqjs.exe	82
PID 4724 wrote to memory of 5028	4724	eppqjs.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eppqjs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eppqjs.exe

C:\Users\Admin\AppData\Local\Temp\payment copy.exe
"C:\Users\Admin\AppData\Local\Temp\payment copy.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\eppqjs.exe
  "C:\Users\Admin\AppData\Local\Temp\eppqjs.exe" C:\Users\Admin\AppData\Local\Temp\sruxqsxca.gz
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\eppqjs.exe
    "C:\Users\Admin\AppData\Local\Temp\eppqjs.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:4724
  - - C:\Windows\SysWOW64\netsh.exe
      "netsh" wlan show profile
      4⤵
      PID:5028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eppqjs.exe

Path C:\Users\Admin\AppData\Local\Temp\eppqjs.exe
Size 65KB
SHA256 c05eb3807e53684ac3889d55cc6773652d1c47240d6a9fc571ca653d7567ee44
MD5 e75bd6740e7669c3d1e46ecdd6493285
SHA1 a15060d3a17a6beb8fc11f6370dd989165c7b04b
SHA512 03cf06a1c967db896d6ed6ff4fd7ca38fcf5c7b3963af8fbe430a5f01e811e99aecbc2b95457f5e9617887f52d743358c2075cf5e2e8a15e8aa3a5c85c77defb
SSDEEP 1536:YIAqBDA3log/a0JD0LMbADk+8+mjk6qKrOqzCJ:rtA3pHDKMUDk+Axr/CJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eppqjs.exe

Path C:\Users\Admin\AppData\Local\Temp\eppqjs.exe
Size 65KB
SHA256 c05eb3807e53684ac3889d55cc6773652d1c47240d6a9fc571ca653d7567ee44
MD5 e75bd6740e7669c3d1e46ecdd6493285
SHA1 a15060d3a17a6beb8fc11f6370dd989165c7b04b
SHA512 03cf06a1c967db896d6ed6ff4fd7ca38fcf5c7b3963af8fbe430a5f01e811e99aecbc2b95457f5e9617887f52d743358c2075cf5e2e8a15e8aa3a5c85c77defb
SSDEEP 1536:YIAqBDA3log/a0JD0LMbADk+8+mjk6qKrOqzCJ:rtA3pHDKMUDk+Axr/CJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eppqjs.exe

Path C:\Users\Admin\AppData\Local\Temp\eppqjs.exe
Size 65KB
SHA256 c05eb3807e53684ac3889d55cc6773652d1c47240d6a9fc571ca653d7567ee44
MD5 e75bd6740e7669c3d1e46ecdd6493285
SHA1 a15060d3a17a6beb8fc11f6370dd989165c7b04b
SHA512 03cf06a1c967db896d6ed6ff4fd7ca38fcf5c7b3963af8fbe430a5f01e811e99aecbc2b95457f5e9617887f52d743358c2075cf5e2e8a15e8aa3a5c85c77defb
SSDEEP 1536:YIAqBDA3log/a0JD0LMbADk+8+mjk6qKrOqzCJ:rtA3pHDKMUDk+Axr/CJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvxxefonp.l

Path C:\Users\Admin\AppData\Local\Temp\pvxxefonp.l
Size 84KB
SHA256 ed77cc31be32503fe1831bf14da662de37dd424743e47a89081125c0d727fbab
MD5 21de640222a811148cf60ee06b2b2d32
SHA1 45487d7f79c5275f755d88ce8d6f37ba486ba918
SHA512 18f9a59c31a4c6664c6127e2c4f4e6bc317cce85f2a0ae64e3f73f426adf80aff13f65a5143e3ca3fbe3783634f24eb2a80cb1e89415bc447f7a87dee74b53ee
SSDEEP 1536:grQ7i+eWzuva0BgYkwS1kSorXXsipjmi5gZTQPQPiSnUADgH:j7i+eWzV0B06HXXs0rbQtnUAa
MD5 SHA1 SHA512 SSDEEP

Submit Download

sruxqsxca.gz

Path C:\Users\Admin\AppData\Local\Temp\sruxqsxca.gz
Size 5KB
SHA256 d15ae43b512e879019d6c3a18878f128835e60fb43088c2d48af41b51ae69625
MD5 d69a1f477d9acd4f44a4c17b1f3f195c
SHA1 31d6fbe615c23fcb1dfee4f3f28a03cea5add845
SHA512 c7eda2038c427574ab6e7fa8a5b87b8fa6cacce24cc02081ba76d7c96292278972c48fa03d918f75b91f19d2c1b87a11836975c972d5022eec232219eae8a553
SSDEEP 96:Ej/dWXAT29KkAcVWBh6QN1lrw8mOgG2uMkl+n7YbjBogKg513a30lI:eEJDAFPJN1y82uMkiiKTEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4724-139-0x0000000004B10000-0x00000000050B4000-memory.dmp

Download

memory/4724-140-0x00000000049F0000-0x0000000004A8C000-memory.dmp

Download

memory/4724-141-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4724-143-0x0000000005C80000-0x0000000005E42000-memory.dmp

Download

memory/4724-144-0x0000000005E50000-0x0000000005EE2000-memory.dmp

Download

memory/4724-145-0x0000000005F60000-0x0000000005F6A000-memory.dmp

Download