snakekeylogger | 15f3c08dff5620da0ef6d33db8dc54d22c4e4dcb4af1abcfd4ea6d08e374b072

General

Target

a.exe
Size

728KB
MD5

a1421248823ec7c199da006cd1bb7db1
SHA1

2da2298dab9a9af9fbb03747430b4d528d4792c1
SHA256

15f3c08dff5620da0ef6d33db8dc54d22c4e4dcb4af1abcfd4ea6d08e374b072
SHA512

bb78de83af2e30472e2d9d28bd56a271a90dfc6d3918099ae0b1483522c8a78b0e64855ee3fd1ac9cb4c4f06eb4a0afe29e09f56fbc139c2168951fe333beb83
SSDEEP

12288:fCp3c2o/vndz/ju0+4WFN5RSmIdbWb9M1eL1PG1Zke:fQc2o/1zS0+15RSmIdbWb9ZP

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
pro40.emailserver.vn
Port:
587
Username:
[email protected]
Password:
Vexa@2013

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org
11	freegeoip.app
12	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 2468	696	a.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3140	2468	WerFault.exe	79

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2468	MSBuild.exe
2468	MSBuild.exe
2468	MSBuild.exe
2468	MSBuild.exe
2468	MSBuild.exe
2468	MSBuild.exe
2468	MSBuild.exe
2468	MSBuild.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
696	a.exe
696	a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	MSBuild.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 4208	696	a.exe	78
PID 696 wrote to memory of 4208	696	a.exe	78
PID 696 wrote to memory of 4208	696	a.exe	78
PID 696 wrote to memory of 2468	696	a.exe	79
PID 696 wrote to memory of 2468	696	a.exe	79
PID 696 wrote to memory of 2468	696	a.exe	79
PID 4208 wrote to memory of 2460	4208	cmd.exe	80
PID 4208 wrote to memory of 2460	4208	cmd.exe	80
PID 4208 wrote to memory of 2460	4208	cmd.exe	80
PID 696 wrote to memory of 2468	696	a.exe	79

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\03c3a7cda963409e9f28aa38670d3ae4.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\03c3a7cda963409e9f28aa38670d3ae4.xml"
    3⤵
    - Creates scheduled task(s)
    PID:2460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\a.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 1788
    3⤵
    - Program crash
    PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2468 -ip 2468
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\03c3a7cda963409e9f28aa38670d3ae4.xml

Filesize
1KB

MD5
6f269664e2d85ef4751b06251480c64d

SHA1
c6603dd2f40b166d3b0f1999ef0b7693ed0863b4

SHA256
cd7ea4acd44e3ffe110c32a42e1d8eab056e368b709767c7a176b68076bf3a1d

SHA512
c1feaead096bc2644098e659d881501a6ff40880acc6c25339776152ed5e4baad132dd69c12849a413d5f973a592c2e0c5fe6fd585813bdf9a8ec7b1d49c2962

Download Submit
memory/696-135-0x000000000095B000-0x0000000000960000-memory.dmp

Filesize
20KB

Download
memory/2468-137-0x0000000000700000-0x000000000076A000-memory.dmp

Filesize
424KB

Download
memory/2468-138-0x0000000004C40000-0x0000000004CDC000-memory.dmp

Filesize
624KB

Download
memory/2468-139-0x0000000005290000-0x0000000005834000-memory.dmp

Filesize
5.6MB

Download
memory/2468-140-0x00000000060F0000-0x00000000062B2000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads