snakekeylogger | d542809530ad2b44819bebd5cdbbb33c212ca4fc0f27080299e151891e8b1be1

Analysis

max time kernel
60s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc201929188800199088696653425546.pdf.exe
Size 447KB
Sample230211-kqgdmscb43
SHA256 d542809530ad2b44819bebd5cdbbb33c212ca4fc0f27080299e151891e8b1be1
MD5 bf800de7ca35b8ae48bd6707699603b7
SHA1 1f78e44e1e819d445c3bd318fc49e19e04328b53
SHA512 efef95fb00740f5d776c6bcc3439a9f9d90e7a715a468bebba8a9a610cb5600bc7363b9ce8187a4e14e6ef21b13862ac189c770d5d1c3a807e0c8043e2f10566
SSDEEP 6144:oYa6yvmeB6N7e9tzGDNb3S1ijcJ8tmrskaR4YUvY6GrS06AC41XJVvMf9DQLnXlw:oYYDqxb32+68tkBVKrk34q9DQLFY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger persistence spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/3928-143-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 3 IoCs

pid	Process
1584	tcejcvaiad.exe
2204	tcejcvaiad.exe
3928	tcejcvaiad.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tcejcvaiad.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tcejcvaiad.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tcejcvaiad.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vkqxbvbah = "C:\\Users\\Admin\\AppData\\Roaming\\ffakrbpyjyb\\qaahephmu.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\tcejcvaiad.exe\" C:\\Users\\Admin\\AppData"	tcejcvaiad.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 3928	1584	tcejcvaiad.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	tcejcvaiad.exe
3928	tcejcvaiad.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1584	tcejcvaiad.exe
1584	tcejcvaiad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	tcejcvaiad.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1584	3736	doc201929188800199088696653425546.pdf.exe	82
PID 3736 wrote to memory of 1584	3736	doc201929188800199088696653425546.pdf.exe	82
PID 3736 wrote to memory of 1584	3736	doc201929188800199088696653425546.pdf.exe	82
PID 1584 wrote to memory of 2204	1584	tcejcvaiad.exe	83
PID 1584 wrote to memory of 2204	1584	tcejcvaiad.exe	83
PID 1584 wrote to memory of 2204	1584	tcejcvaiad.exe	83
PID 1584 wrote to memory of 3928	1584	tcejcvaiad.exe	84
PID 1584 wrote to memory of 3928	1584	tcejcvaiad.exe	84
PID 1584 wrote to memory of 3928	1584	tcejcvaiad.exe	84
PID 1584 wrote to memory of 3928	1584	tcejcvaiad.exe	84

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tcejcvaiad.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	tcejcvaiad.exe

C:\Users\Admin\AppData\Local\Temp\doc201929188800199088696653425546.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\doc201929188800199088696653425546.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
  "C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe" C:\Users\Admin\AppData\Local\Temp\zjrdukipnb.z
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
    "C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe"
    3⤵
    - Executes dropped EXE
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
    "C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:3928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tcejcvaiad.exe

Path C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
Size 122KB
SHA256 274e700aeab9a8df40795b71be7bd51dcc07e10639ce7d5f4b08a9319d63038c
MD5 f5b296817ff320929d5d546de2cf7181
SHA1 ed883a861a69ecc65763f14be7e317858d26f708
SHA512 b28130712e9e0b2d9d367a8bc87f2b6544a1738f3d37579e3c3ab648d86399386e75c183c4475616a497d8488cf8ebb78a69aa99be0d7e9423988f879cd8c64d
SSDEEP 3072:nhfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPv2aDAi:VJJtBYcpn/ez7pzkCivAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcejcvaiad.exe

Path C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
Size 122KB
SHA256 274e700aeab9a8df40795b71be7bd51dcc07e10639ce7d5f4b08a9319d63038c
MD5 f5b296817ff320929d5d546de2cf7181
SHA1 ed883a861a69ecc65763f14be7e317858d26f708
SHA512 b28130712e9e0b2d9d367a8bc87f2b6544a1738f3d37579e3c3ab648d86399386e75c183c4475616a497d8488cf8ebb78a69aa99be0d7e9423988f879cd8c64d
SSDEEP 3072:nhfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPv2aDAi:VJJtBYcpn/ez7pzkCivAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcejcvaiad.exe

Path C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
Size 122KB
SHA256 274e700aeab9a8df40795b71be7bd51dcc07e10639ce7d5f4b08a9319d63038c
MD5 f5b296817ff320929d5d546de2cf7181
SHA1 ed883a861a69ecc65763f14be7e317858d26f708
SHA512 b28130712e9e0b2d9d367a8bc87f2b6544a1738f3d37579e3c3ab648d86399386e75c183c4475616a497d8488cf8ebb78a69aa99be0d7e9423988f879cd8c64d
SSDEEP 3072:nhfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPv2aDAi:VJJtBYcpn/ez7pzkCivAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcejcvaiad.exe

Path C:\Users\Admin\AppData\Local\Temp\tcejcvaiad.exe
Size 122KB
SHA256 274e700aeab9a8df40795b71be7bd51dcc07e10639ce7d5f4b08a9319d63038c
MD5 f5b296817ff320929d5d546de2cf7181
SHA1 ed883a861a69ecc65763f14be7e317858d26f708
SHA512 b28130712e9e0b2d9d367a8bc87f2b6544a1738f3d37579e3c3ab648d86399386e75c183c4475616a497d8488cf8ebb78a69aa99be0d7e9423988f879cd8c64d
SSDEEP 3072:nhfSAPbxJt8vSRbKc2lMn/ez7W1YyqDzkydo/8NiEXIgdKPv2aDAi:VJJtBYcpn/ez7pzkCivAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

uiqxdfojc.xbv

Path C:\Users\Admin\AppData\Local\Temp\uiqxdfojc.xbv
Size 226KB
SHA256 f1e2283ebd1d53cf3042410e43855a25c361a0212c8b68d58a659951597e6161
MD5 5042587e238b04c8122366ec4013466e
SHA1 2132da2aae5769a5c68880a07761da09448ff3cf
SHA512 6b1450fc29e1657f490e06d1d120dfe94ba95b00d0aff5da0f02f802d94661fd81a978acfe578e31aa8aca854cd3caacb84a59b88c2d2e7fb23b012535e854fa
SSDEEP 3072:XrO2hXRs1zh+F5/zg/hjuZyND7jMv6aOXLYzNNMQsYOzV1wY6XrsZC/pPGMW+b4t:XfhXQYtkZjfJ7ju2LHHKrw0AA4t
MD5 SHA1 SHA512 SSDEEP

Submit Download

zjrdukipnb.z

Path C:\Users\Admin\AppData\Local\Temp\zjrdukipnb.z
Size 7KB
SHA256 57bec0f891649992bb229fcd6527f2c8963ba3094fa03644705f569138b92c0f
MD5 30864d8e08af4ad02ffef3fecbac0d32
SHA1 b4cfcbd565e3d92b69ad0d25ba1ce565a6518dfc
SHA512 a5650cd05bee5a3e2ca5ae40cacbcd85ab3b5f7ad39c5ada571260d86c9da63af33da0482b8584a87153f2414641c57ba8a9ed0aff2e32123ca75814c9064fa6
SSDEEP 192:darcitQvArWiPvAub9ndicK9AIsLQ4TzVWKAGdtC8MmLh:uCYrNPvAwpKAIss4HVTaTm9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3928-141-0x0000000005780000-0x0000000005D24000-memory.dmp

Download

memory/3928-142-0x0000000005270000-0x000000000530C000-memory.dmp

Download

memory/3928-143-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/3928-144-0x0000000006530000-0x00000000066F2000-memory.dmp

Download

memory/3928-145-0x0000000006400000-0x0000000006492000-memory.dmp

Download

memory/3928-146-0x00000000063C0000-0x00000000063CA000-memory.dmp

Download