snakekeylogger | e43cd083a5db05eb390580af3cc8bcf29561d080e07dfbcc66c2388b8b16c454

General

Target

RFQ_Order No 43456767.js
Size

3.3MB
MD5

31402979093a6fa8d82437f4c00fdc1e
SHA1

3677af496413e8f925d10e05845a949ad71484a5
SHA256

e43cd083a5db05eb390580af3cc8bcf29561d080e07dfbcc66c2388b8b16c454
SHA512

60d81c88ce2042b91fbf9420dcbef223e91d4064203e8e6bbcebf018b67fe3574f9a437305d145dabeea8dbabec8b1d9679fc56c0cdcdc51984b0a79ff175002
SSDEEP

3072:vkbNExKp0pfpkVU5fzTyb+NuDj/yefrgd84HHM2PQOTWV/g8Ub34mOF3tgsfp9ka:vkbyHHRyV/g8U8mLsEdVARKNNKH

Score

10^/10

snakekeylogger vjw0rm collection keylogger spyware stealer trojan worm

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.l3hharris.com
Port:
587
Username:
[email protected]
Password:
^JHAkmP2

C2

https://api.telegram.org/bot6151161707:AAGijmYc_-96Khu0IawsMazfJVDSOx_Z96g/sendMessage?chat_id=2006294595

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001230a-58.dat	family_snakekeylogger
behavioral1/files/0x000a00000001230a-59.dat	family_snakekeylogger
behavioral1/memory/596-61-0x0000000000D30000-0x0000000000D56000-memory.dmp	family_snakekeylogger

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 16 IoCs

flow	pid	Process
5	968	wscript.exe
8	968	wscript.exe
9	968	wscript.exe
12	968	wscript.exe
13	968	wscript.exe
14	968	wscript.exe
16	968	wscript.exe
17	968	wscript.exe
18	968	wscript.exe
20	968	wscript.exe
21	968	wscript.exe
22	968	wscript.exe
24	968	wscript.exe
25	968	wscript.exe
26	968	wscript.exe
28	968	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fLPzlqQNLm.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fLPzlqQNLm.js	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
596	TELEGRAM-RAW.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	TELEGRAM-RAW.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	TELEGRAM-RAW.exe
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	TELEGRAM-RAW.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	checkip.dyndns.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
596	TELEGRAM-RAW.exe
596	TELEGRAM-RAW.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	596	TELEGRAM-RAW.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 968	852	wscript.exe	28
PID 852 wrote to memory of 968	852	wscript.exe	28
PID 852 wrote to memory of 968	852	wscript.exe	28
PID 852 wrote to memory of 596	852	wscript.exe	29
PID 852 wrote to memory of 596	852	wscript.exe	29
PID 852 wrote to memory of 596	852	wscript.exe	29
PID 852 wrote to memory of 596	852	wscript.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	TELEGRAM-RAW.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	TELEGRAM-RAW.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ_Order No 43456767.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\fLPzlqQNLm.js"
  2⤵
  - Blocklisted process makes network request
  - Drops startup file
  PID:968
- C:\Users\Admin\AppData\Local\Temp\TELEGRAM-RAW.exe
  "C:\Users\Admin\AppData\Local\Temp\TELEGRAM-RAW.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TELEGRAM-RAW.exe

Filesize
127KB

MD5
513f41b6402d6c0f9dade0316091ce84

SHA1
230019868da7b804b6218c5c0e4790915c9cc821

SHA256
3d499ccccf5f8ec92be049bb72964b0762b5da99ff7e0280f77284df6e042b4e

SHA512
bff6b9f0d955b52b6f2271a3503b84a6323082b8320401ea1961dbad824431b7872775d793219b5986c34657f0c39a5f3ed130e0b840850682ed60c31ded0a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TELEGRAM-RAW.exe

Filesize
127KB

MD5
513f41b6402d6c0f9dade0316091ce84

SHA1
230019868da7b804b6218c5c0e4790915c9cc821

SHA256
3d499ccccf5f8ec92be049bb72964b0762b5da99ff7e0280f77284df6e042b4e

SHA512
bff6b9f0d955b52b6f2271a3503b84a6323082b8320401ea1961dbad824431b7872775d793219b5986c34657f0c39a5f3ed130e0b840850682ed60c31ded0a8a

Download Submit
C:\Users\Admin\AppData\Roaming\fLPzlqQNLm.js

Filesize
1.1MB

MD5
3371f1d8cc7aca68933bd82eb8993e20

SHA1
86120d2a121d4baa4e4893eda05c68770dfa2eca

SHA256
839ba66fffe59e78275921a80e2cb4fd9a132907aa86057bdcecf3945cf0c7dc

SHA512
7d8bc47dbc865013cb70935535c51a319ecfdfeefd18b5ba476545dd14c8fc3cb37753e04c7d30d8d6760522bae6b139e2437948e82468eff96ba5fb069b6a7f

Download Submit
memory/596-61-0x0000000000D30000-0x0000000000D56000-memory.dmp

Filesize
152KB

Download
memory/596-62-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/852-54-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing