snakekeylogger | 831e8ce3737eb50cf77ef5d14a4af9370cd3fa6c4a6db7c0566ddea968e9a2a9

Analysis

max time kernel
91s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2023, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL AWB DOCUMENTS.exe
Size 250KB
Sample230127-rbjzjsch7t
SHA256 831e8ce3737eb50cf77ef5d14a4af9370cd3fa6c4a6db7c0566ddea968e9a2a9
MD5 25d12df40b5528fd8eb4385e5ddcf60d
SHA1 ccca7df544d234130b35c5477cbddc5d5decb619
SHA512 2c191251fb59d3a1a9950270841c3e189a1f7b252c125b5684ca0d03c17030073214b6195fcd83c9e781022af73036fdb0c05ac14c1844092f80bdd60d30a2b4
SSDEEP 6144:/Ya6i74akTBwn7tB+9eQeQRQlvNiLZZL0bd1ycHoqIL:/YEkakTenvaL4NiUd1yf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/1664-141-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
4596	qtvwohs.exe
1664	qtvwohs.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qtvwohs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qtvwohs.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qtvwohs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 1664	4596	qtvwohs.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	qtvwohs.exe
1664	qtvwohs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4596	qtvwohs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	qtvwohs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4596	4972	DHL AWB DOCUMENTS.exe	81
PID 4972 wrote to memory of 4596	4972	DHL AWB DOCUMENTS.exe	81
PID 4972 wrote to memory of 4596	4972	DHL AWB DOCUMENTS.exe	81
PID 4596 wrote to memory of 1664	4596	qtvwohs.exe	82
PID 4596 wrote to memory of 1664	4596	qtvwohs.exe	82
PID 4596 wrote to memory of 1664	4596	qtvwohs.exe	82
PID 4596 wrote to memory of 1664	4596	qtvwohs.exe	82

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qtvwohs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qtvwohs.exe

C:\Users\Admin\AppData\Local\Temp\DHL AWB DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL AWB DOCUMENTS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe
  "C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe" C:\Users\Admin\AppData\Local\Temp\bcdqh.xfg
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe
    "C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bcdqh.xfg

Path C:\Users\Admin\AppData\Local\Temp\bcdqh.xfg
Size 6KB
SHA256 8cad6a01889b7c10aaf87bb2bd5a80187d9a2e6228cf935e4e2037f281d834ba
MD5 a19ed6a318d4b0c1b973e5f1567bb2c0
SHA1 97d31ad8128ba375a4923a2e1a5c4d275f296c09
SHA512 828e00f8e37e43d4b087395db312dc374cc93a72cdcb710cf39f9fddfba01e9a7d21694200bb37c278a1ee6c47061951a476560bb8740f274bd02f9a42ee5519
SSDEEP 96:Farc6oY1g/DrYuOk2XO5oSwsChcWlJI6iSnsR4dlFdib/7d/LFEUD3AL0+hqwx8n:FarcRJWhX1Sh9i1IQlnirZ/LbizzzPgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

obblbrvwm.nsf

Path C:\Users\Admin\AppData\Local\Temp\obblbrvwm.nsf
Size 226KB
SHA256 49e2caa3abb04ae1cedfb2438d4ccb01ed5ad92cbc2bbb163b8faa61c3a98e7e
MD5 6181ee165a80a02030b42ad62438e3ff
SHA1 255a73e8eb3d5a5f44c227618524ad7d7ab74024
SHA512 93bfb169fc690bc76600872113fa380e2d1ed45a299ed38c2d1f1eee841f59a9fe4412991f8cbfd0a5e672cc336825f9cae514ebf6457f1efbc13a66e1fca911
SSDEEP 6144:2+JXLKK8O2GSA/6Vej+ehgB68nD1O8BRh0M9z:2g5lCZkSemB6iDgGR7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtvwohs.exe

Path C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe
Size 50KB
SHA256 a2e015c7dc4df597372a0a71ae2345d99fd467ea403a08a6dfba880d693421d8
MD5 b57f6cc9ca480f1056cfae4e8969b769
SHA1 e191ba43eb4eb08fdf2e23aacfffbb87ab89039d
SHA512 38725c105d857d632e80d454c708efa1533a0f318e0b76b87a86958bd1b27227fcea4f5306dedb9e4b707fd44af16ca94865508792401522a6e920c1fd62232c
SSDEEP 768:Wh1VzJWGSDi3MRUlUyd58bYdREeW6Yeq4ReXkz/QGuNKBW7MdTJ:2kGSDiQWz3jRB7QGXHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtvwohs.exe

Path C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe
Size 50KB
SHA256 a2e015c7dc4df597372a0a71ae2345d99fd467ea403a08a6dfba880d693421d8
MD5 b57f6cc9ca480f1056cfae4e8969b769
SHA1 e191ba43eb4eb08fdf2e23aacfffbb87ab89039d
SHA512 38725c105d857d632e80d454c708efa1533a0f318e0b76b87a86958bd1b27227fcea4f5306dedb9e4b707fd44af16ca94865508792401522a6e920c1fd62232c
SSDEEP 768:Wh1VzJWGSDi3MRUlUyd58bYdREeW6Yeq4ReXkz/QGuNKBW7MdTJ:2kGSDiQWz3jRB7QGXHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtvwohs.exe

Path C:\Users\Admin\AppData\Local\Temp\qtvwohs.exe
Size 50KB
SHA256 a2e015c7dc4df597372a0a71ae2345d99fd467ea403a08a6dfba880d693421d8
MD5 b57f6cc9ca480f1056cfae4e8969b769
SHA1 e191ba43eb4eb08fdf2e23aacfffbb87ab89039d
SHA512 38725c105d857d632e80d454c708efa1533a0f318e0b76b87a86958bd1b27227fcea4f5306dedb9e4b707fd44af16ca94865508792401522a6e920c1fd62232c
SSDEEP 768:Wh1VzJWGSDi3MRUlUyd58bYdREeW6Yeq4ReXkz/QGuNKBW7MdTJ:2kGSDiQWz3jRB7QGXHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1664-139-0x0000000004A80000-0x0000000005024000-memory.dmp

Download

memory/1664-140-0x0000000004990000-0x0000000004A2C000-memory.dmp

Download

memory/1664-141-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1664-142-0x0000000005B50000-0x0000000005D12000-memory.dmp

Download

memory/1664-143-0x0000000005D20000-0x0000000005DB2000-memory.dmp

Download

memory/1664-144-0x0000000005E30000-0x0000000005E3A000-memory.dmp

Download