snakekeylogger | 04678ba1322f3fcb1f5cfb0ef0389da80d1c786e753f74a39d38407558b3bf41

Analysis

max time kernel
126s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/02/2023, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hesaphareketi-01.exe
Size 465KB
Sample230207-pll6jsbf52
SHA256 04678ba1322f3fcb1f5cfb0ef0389da80d1c786e753f74a39d38407558b3bf41
MD5 77f09e38ffda6ba8f7a51f40d11ad555
SHA1 841ed8c5ebb30603a94b7cd8c19fd28272059a4f
SHA512 5b339e165004e889f4360392c6b204a37b96ef6f099d4c04aae7bb10c476cd2e82b3fcef2c8a6e96974b7c207943fa47ac80c859fa62d97b1a5f9ef56a51ad40
SSDEEP 12288:8YnF2b1e70hdlfLK2wD7BOgDMoKRbvfEh65hik:8Yq007FLKh7BpxO7EUr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger persistence stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4996-141-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 3 IoCs

pid	Process
808	iglpkkbdzi.exe
640	iglpkkbdzi.exe
4996	iglpkkbdzi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qcdpa = "C:\\Users\\Admin\\AppData\\Roaming\\gnglltcx\\acwohstin.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\iglpkkbdzi.exe\" C:\\Users\\Admin\\AppData\\Lo"	iglpkkbdzi.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 4996	808	iglpkkbdzi.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	4996	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4996	iglpkkbdzi.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
808	iglpkkbdzi.exe
808	iglpkkbdzi.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4996	iglpkkbdzi.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 808	4644	hesaphareketi-01.exe	82
PID 4644 wrote to memory of 808	4644	hesaphareketi-01.exe	82
PID 4644 wrote to memory of 808	4644	hesaphareketi-01.exe	82
PID 808 wrote to memory of 640	808	iglpkkbdzi.exe	83
PID 808 wrote to memory of 640	808	iglpkkbdzi.exe	83
PID 808 wrote to memory of 640	808	iglpkkbdzi.exe	83
PID 808 wrote to memory of 4996	808	iglpkkbdzi.exe	84
PID 808 wrote to memory of 4996	808	iglpkkbdzi.exe	84
PID 808 wrote to memory of 4996	808	iglpkkbdzi.exe	84
PID 808 wrote to memory of 4996	808	iglpkkbdzi.exe	84

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
  "C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe" C:\Users\Admin\AppData\Local\Temp\lgsct.nn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
    "C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe"
    3⤵
    - Executes dropped EXE
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
    "C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 1488
      4⤵
      Program crash
      PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4996 -ip 4996
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

iglpkkbdzi.exe

Path C:\Users\Admin\AppData\Local\Temp\iglpkkbdzi.exe
Size 130KB
SHA256 8fc86a0c5abd605a0d648d15c0d58b1de9f5d1ebf5cb3b027bec147ebdf64d9c
MD5 0766e047953a9a6b02c99f356f1337de
SHA1 b190508068c1f53a1e86bcf8dd268f9a057f9fc6
SHA512 a813625423ffb1a4e954042d22baa64d554c0ce6d4eb456625e2c98d3486f3f6aa7704b2312480886ea6350e14ca1b6cc65df45fb4018a26a3869b040eff84b1
SSDEEP 1536:1dx1IKgbTK9n+iO2UzWe1+M+v6TGabh/b9QWWGuld6YpcA2suPtMO/b6qf7meggO:p1+a614qVbh/b9QWpocYpxEtPf7megt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ityxutcn.dbi

Path C:\Users\Admin\AppData\Local\Temp\ityxutcn.dbi
Size 225KB
SHA256 d22f62bd71df24b2e3fbddf3bfc692891b06f8d3d2e30e632aec6bd7a077c9b0
MD5 854f0d86e5e154e135f949e6211e16b2
SHA1 b1de87c012dada151774ac76feec7c19351c500b
SHA512 d6050bcf89b51a724ecc40afd996d68ed60fe3214f11c9be28c7a8ebde607c6d619f53e3b72a503e1b09ba8fe95705dba5d6dd285fc93df00067d22f6010b2ad
SSDEEP 6144:juiZjG3/EIUmipWPXFg8vvHfvC8BlInZrfz4hGp9YA+sLS/Qwj82L6NVyJ94Vp/g:vgT/Q9rCi9Y+S/Qa81NV29WJFVEj
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgsct.nn

Path C:\Users\Admin\AppData\Local\Temp\lgsct.nn
Size 7KB
SHA256 71735b575f4ef4c53559c6457fa8ddec20261038c9fc9fb922b71a55631d2f4e
MD5 fcbe79a8557d88354eeebdb4f646037c
SHA1 3dcedcd709d3d8fc5b58bfcf695cbbf9a210ef7e
SHA512 f9d96793677b7800a3774dcbe2768c2d02a3d5434ef574640fa18b81cbda134006c61b25587fba692ab23e3753b7103738a4718731ed5697e577418c9d108c54
SSDEEP 192:darcitQvArWiPvxuKb9le563ZGbnmv6pLtNI7ypzV:uCYrNPvgMnpGe6XNI7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4996-141-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/4996-142-0x00000000056D0000-0x0000000005C74000-memory.dmp

Download

memory/4996-143-0x00000000051D0000-0x000000000526C000-memory.dmp

Download