snakekeylogger | e66025dcb5f228e159f82d46dacc744b4abbaf2b89b16e078471d7af3a40dfda

Analysis

max time kernel
45s
max time network
114s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/02/2023, 18:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.exe
Size 450KB
Sample230208-w5he2aec24
SHA256 e66025dcb5f228e159f82d46dacc744b4abbaf2b89b16e078471d7af3a40dfda
MD5 e03d95e9cab9d71237a2c94cf63b6134
SHA1 594b269a6ac895f1eaadcb2124906e671529a447
SHA512 6573590d08400df621734fe7c6a305210fb1f2401cac0f2a5437adbaa3b21c8709b009edf14c18dfa51dcc61cefa053bb1038244ba59a06c2b986ca59bd5444d
SSDEEP 6144:8Ya6SHPGTjpoWc7EBeQaYVqFKABXmxw+RuVXgoknZCN0XMpnTFMPbEaotYi7i2sw:8YgHPGpRccRarfBiQWok0pTyPQvtJ7F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6102267622:AAFFZ_GvUj4OisNxsdlwZ5OHZVEfanDQBf0/sendMessage?chat_id=6107719374

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

resource	yara_rule
behavioral1/memory/1340-66-0x0000000000440000-0x0000000000466000-memory.dmp	family_snakekeylogger
behavioral1/memory/1340-67-0x0000000000440000-0x0000000000466000-memory.dmp	family_snakekeylogger
behavioral1/memory/1340-68-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1648	qsavrqmrw.exe
1340	qsavrqmrw.exe

Loads dropped DLL 3 IoCs

pid	Process
1632	PO.exe
1632	PO.exe
1648	qsavrqmrw.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qsavrqmrw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qsavrqmrw.exe
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qsavrqmrw.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 1340	1648	qsavrqmrw.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1340	qsavrqmrw.exe
1340	qsavrqmrw.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1648	qsavrqmrw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	qsavrqmrw.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1648	1632	PO.exe	28
PID 1632 wrote to memory of 1648	1632	PO.exe	28
PID 1632 wrote to memory of 1648	1632	PO.exe	28
PID 1632 wrote to memory of 1648	1632	PO.exe	28
PID 1648 wrote to memory of 1340	1648	qsavrqmrw.exe	29
PID 1648 wrote to memory of 1340	1648	qsavrqmrw.exe	29
PID 1648 wrote to memory of 1340	1648	qsavrqmrw.exe	29
PID 1648 wrote to memory of 1340	1648	qsavrqmrw.exe	29
PID 1648 wrote to memory of 1340	1648	qsavrqmrw.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qsavrqmrw.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	qsavrqmrw.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
  "C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe" C:\Users\Admin\AppData\Local\Temp\zivstchz.jvj
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
    "C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qsavrqmrw.exe

Path C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
Size 120KB
SHA256 89727fdd0839137432ff811c768a0d7314801027404c558c0b68689fa2215644
MD5 7d09b577dbf223b407135acca4a8c708
SHA1 a2f46a560047a87d308f5f68959c34b9f6357d5a
SHA512 21350361067df85bc46fb4ed8e89abfc073a49c357c00655e75a3a6699a521c4e2e9c8e81c223830b4138e089ac20fc5e37e1014d658589199762434e1f4452d
SSDEEP 1536:h4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:eZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsavrqmrw.exe

Path C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
Size 120KB
SHA256 89727fdd0839137432ff811c768a0d7314801027404c558c0b68689fa2215644
MD5 7d09b577dbf223b407135acca4a8c708
SHA1 a2f46a560047a87d308f5f68959c34b9f6357d5a
SHA512 21350361067df85bc46fb4ed8e89abfc073a49c357c00655e75a3a6699a521c4e2e9c8e81c223830b4138e089ac20fc5e37e1014d658589199762434e1f4452d
SSDEEP 1536:h4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:eZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsavrqmrw.exe

Path C:\Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
Size 120KB
SHA256 89727fdd0839137432ff811c768a0d7314801027404c558c0b68689fa2215644
MD5 7d09b577dbf223b407135acca4a8c708
SHA1 a2f46a560047a87d308f5f68959c34b9f6357d5a
SHA512 21350361067df85bc46fb4ed8e89abfc073a49c357c00655e75a3a6699a521c4e2e9c8e81c223830b4138e089ac20fc5e37e1014d658589199762434e1f4452d
SSDEEP 1536:h4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:eZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vxhkhqprx.ym

Path C:\Users\Admin\AppData\Local\Temp\vxhkhqprx.ym
Size 225KB
SHA256 80f3cdae6afac873615c81c3c4ccd7d48161cb84038682ae7b694612655a1aac
MD5 eb617270942815be8eb534ae15b1247c
SHA1 978bc7416cab6925ec97aaa8b098310f71757657
SHA512 096ca24c9fa3db268856b7ba2be4f668b83209d8093702dccc346b02e2dd1900a55137a782e9546553f8205730a83a47853615074548c6e936621530fe4617f4
SSDEEP 6144:DiJyWjFO08BuTyfJOruYJuOzNouUznCe8CVL:DiYEM08BAwauYJfeuUz7VL
MD5 SHA1 SHA512 SSDEEP

Submit Download

zivstchz.jvj

Path C:\Users\Admin\AppData\Local\Temp\zivstchz.jvj
Size 5KB
SHA256 8abd3738a18bd2fa57e288a86b074240e2cff5adf444786f9cd45ff42691804a
MD5 18fb8fe24d9cb010303c7ffdf7a4b7e6
SHA1 8ae8c22ec40699f70af0c722f0027889f70867de
SHA512 06c3283a35394701cffe4721efa7f048faa68a5b2b2cbb8e73e1ce0be8e22d6e2fe7e67227a59b94a294aacfde499ff06ce31bc682bccdfe05f283a0fe0f1ac3
SSDEEP 96:Farc6oYAg/DrYuJk2XO5oSwsZpij1w890yp03i6GlNZq7zmzuZPeed:FarcRARhX1ShZwjO89/p03sZ9zSt
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsavrqmrw.exe

Path \Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
Size 120KB
SHA256 89727fdd0839137432ff811c768a0d7314801027404c558c0b68689fa2215644
MD5 7d09b577dbf223b407135acca4a8c708
SHA1 a2f46a560047a87d308f5f68959c34b9f6357d5a
SHA512 21350361067df85bc46fb4ed8e89abfc073a49c357c00655e75a3a6699a521c4e2e9c8e81c223830b4138e089ac20fc5e37e1014d658589199762434e1f4452d
SSDEEP 1536:h4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:eZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsavrqmrw.exe

Path \Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
Size 120KB
SHA256 89727fdd0839137432ff811c768a0d7314801027404c558c0b68689fa2215644
MD5 7d09b577dbf223b407135acca4a8c708
SHA1 a2f46a560047a87d308f5f68959c34b9f6357d5a
SHA512 21350361067df85bc46fb4ed8e89abfc073a49c357c00655e75a3a6699a521c4e2e9c8e81c223830b4138e089ac20fc5e37e1014d658589199762434e1f4452d
SSDEEP 1536:h4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:eZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsavrqmrw.exe

Path \Users\Admin\AppData\Local\Temp\qsavrqmrw.exe
Size 120KB
SHA256 89727fdd0839137432ff811c768a0d7314801027404c558c0b68689fa2215644
MD5 7d09b577dbf223b407135acca4a8c708
SHA1 a2f46a560047a87d308f5f68959c34b9f6357d5a
SHA512 21350361067df85bc46fb4ed8e89abfc073a49c357c00655e75a3a6699a521c4e2e9c8e81c223830b4138e089ac20fc5e37e1014d658589199762434e1f4452d
SSDEEP 1536:h4GyOx0qu+1IGdwSEjPW7zr9iyQ641xIon1qbg5B85smnRlMz/sL+y4inSDb7GpC:eZSk+8SEDWPrEPrlfgl0st47D/G+aF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-66-0x0000000000440000-0x0000000000466000-memory.dmp

Download

memory/1340-67-0x0000000000440000-0x0000000000466000-memory.dmp

Download

memory/1340-68-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1632-54-0x0000000076091000-0x0000000076093000-memory.dmp

Download