snakekeylogger | 04678ba1322f3fcb1f5cfb0ef0389da80d1c786e753f74a39d38407558b3bf41

Analysis

max time kernel
28s
max time network
112s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/02/2023, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hesaphareketi-01.exe
Size 465KB
Sample230207-pll6jsbf52
SHA256 04678ba1322f3fcb1f5cfb0ef0389da80d1c786e753f74a39d38407558b3bf41
MD5 77f09e38ffda6ba8f7a51f40d11ad555
SHA1 841ed8c5ebb30603a94b7cd8c19fd28272059a4f
SHA512 5b339e165004e889f4360392c6b204a37b96ef6f099d4c04aae7bb10c476cd2e82b3fcef2c8a6e96974b7c207943fa47ac80c859fa62d97b1a5f9ef56a51ad40
SSDEEP 12288:8YnF2b1e70hdlfLK2wD7BOgDMoKRbvfEh65hik:8Yq007FLKh7BpxO7EUr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger persistence spyware stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5843567515:AAEdtJWwcJKNn64U81CKVdG-li_Ejds8raM/sendMessage?chat_id=1639214896

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

resource	yara_rule
behavioral1/memory/1440-66-0x0000000000250000-0x0000000000276000-memory.dmp	family_snakekeylogger
behavioral1/memory/1440-67-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1312	iglpkkbdzi.exe
1440	iglpkkbdzi.exe

Loads dropped DLL 2 IoCs

pid	Process
1160	hesaphareketi-01.exe
1312	iglpkkbdzi.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iglpkkbdzi.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iglpkkbdzi.exe
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iglpkkbdzi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\qcdpa = "C:\\Users\\Admin\\AppData\\Roaming\\gnglltcx\\acwohstin.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\iglpkkbdzi.exe\" C:\\Users\\Admin\\AppData\\Lo"	iglpkkbdzi.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1312 set thread context of 1440	1312	iglpkkbdzi.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1440	iglpkkbdzi.exe
1440	iglpkkbdzi.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1312	iglpkkbdzi.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	iglpkkbdzi.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1312	1160	hesaphareketi-01.exe	28
PID 1160 wrote to memory of 1312	1160	hesaphareketi-01.exe	28
PID 1160 wrote to memory of 1312	1160	hesaphareketi-01.exe	28
PID 1160 wrote to memory of 1312	1160	hesaphareketi-01.exe	28
PID 1312 wrote to memory of 1440	1312	iglpkkbdzi.exe	29
PID 1312 wrote to memory of 1440	1312	iglpkkbdzi.exe	29
PID 1312 wrote to memory of 1440	1312	iglpkkbdzi.exe	29
PID 1312 wrote to memory of 1440	1312	iglpkkbdzi.exe	29
PID 1312 wrote to memory of 1440	1312	iglpkkbdzi.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iglpkkbdzi.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iglpkkbdzi.exe

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
  "C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe" C:\Users\Admin\AppData\Local\Temp\lgsct.nn
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
    "C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ityxutcn.dbi

Path C:\Users\Admin\AppData\Local\Temp\ityxutcn.dbi
Size 225KB
SHA256 d22f62bd71df24b2e3fbddf3bfc692891b06f8d3d2e30e632aec6bd7a077c9b0
MD5 854f0d86e5e154e135f949e6211e16b2
SHA1 b1de87c012dada151774ac76feec7c19351c500b
SHA512 d6050bcf89b51a724ecc40afd996d68ed60fe3214f11c9be28c7a8ebde607c6d619f53e3b72a503e1b09ba8fe95705dba5d6dd285fc93df00067d22f6010b2ad
SSDEEP 6144:juiZjG3/EIUmipWPXFg8vvHfvC8BlInZrfz4hGp9YA+sLS/Qwj82L6NVyJ94Vp/g:vgT/Q9rCi9Y+S/Qa81NV29WJFVEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgsct.nn

Path C:\Users\Admin\AppData\Local\Temp\lgsct.nn
Size 7KB
SHA256 71735b575f4ef4c53559c6457fa8ddec20261038c9fc9fb922b71a55631d2f4e
MD5 fcbe79a8557d88354eeebdb4f646037c
SHA1 3dcedcd709d3d8fc5b58bfcf695cbbf9a210ef7e
SHA512 f9d96793677b7800a3774dcbe2768c2d02a3d5434ef574640fa18b81cbda134006c61b25587fba692ab23e3753b7103738a4718731ed5697e577418c9d108c54
SSDEEP 192:darcitQvArWiPvxuKb9le563ZGbnmv6pLtNI7ypzV:uCYrNPvgMnpGe6XNI7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path \Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path \Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1160-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Download

memory/1440-66-0x0000000000250000-0x0000000000276000-memory.dmp

Download

memory/1440-67-0x0000000000400000-0x0000000000437000-memory.dmp

Download