snakekeylogger | 8447a1c529bb04ac97e6b9ad4ebbf0ee99d64af1a7cdb52ba4347906056bdcbf

Analysis

max time kernel
91s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2023, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crypted file.exe
Size 197KB
Sample230214-t5d2haef79
SHA256 8447a1c529bb04ac97e6b9ad4ebbf0ee99d64af1a7cdb52ba4347906056bdcbf
MD5 7a32c1928846d1043e443474fa6549c2
SHA1 90dc678dc61fc932b17b20e2f2ae0d50a5a0e094
SHA512 2f47aec259d6a27dd1ff075820cec3274e1dde2dcadd9408f744738b409cf2cf491a893fae89ffbdbfba405a74484d86df53abd20077cab46f411eda1518c90b
SSDEEP 3072:HfY/TU9fE9PEtuXbEH0dveCvCzm+hNvKTovGunhfPIKRy/3jZaHeZSLk08MbE42z:/Ya6RHvvwbhNvGANlPAVaHGBIE42z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger persistence spyware stealer upx

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2160-139-0x0000000000400000-0x000000000043A000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
3964	cknmloy.exe
2160	cknmloy.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2160-139-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cknmloy.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cknmloy.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cknmloy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nwsclhqmv = "C:\\Users\\Admin\\AppData\\Roaming\\jsoxhdmv\\ravfoktdyie.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\cknmloy.exe\" C:\\Users\\Admin\\AppData\\Loc"	cknmloy.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3964 set thread context of 2160	3964	cknmloy.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2160	cknmloy.exe
2160	cknmloy.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3964	cknmloy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	cknmloy.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3964	4972	crypted file.exe	80
PID 4972 wrote to memory of 3964	4972	crypted file.exe	80
PID 4972 wrote to memory of 3964	4972	crypted file.exe	80
PID 3964 wrote to memory of 2160	3964	cknmloy.exe	81
PID 3964 wrote to memory of 2160	3964	cknmloy.exe	81
PID 3964 wrote to memory of 2160	3964	cknmloy.exe	81
PID 3964 wrote to memory of 2160	3964	cknmloy.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cknmloy.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	cknmloy.exe

C:\Users\Admin\AppData\Local\Temp\crypted file.exe
"C:\Users\Admin\AppData\Local\Temp\crypted file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\cknmloy.exe
  "C:\Users\Admin\AppData\Local\Temp\cknmloy.exe" C:\Users\Admin\AppData\Local\Temp\hmirxzgbs.d
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Users\Admin\AppData\Local\Temp\cknmloy.exe
    "C:\Users\Admin\AppData\Local\Temp\cknmloy.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cknmloy.exe

Path C:\Users\Admin\AppData\Local\Temp\cknmloy.exe
Size 101KB
SHA256 3b50796d11c0837412a2d9205f28604ef9c02ea436e33f9cb46ac3b99e1bbc37
MD5 80077deafb8ecaf4f3ee72bc61d01132
SHA1 028fef0cbdd7c73e90082ce544e9c988d68a5098
SHA512 7ea525b584bc684a72e75e0e6ba7f125eb1f9d70e16b7125df1b4add3c808fdfec4547cf27ba5f855b57c7a63bbb7ddff7a558c7212c3c031b729281cc7028f0
SSDEEP 3072:ol4uZqBztqXqi24XBkFJ1Og9e0DvZCF/OJ:glZ4MXKWc1Vu/OJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cknmloy.exe

Path C:\Users\Admin\AppData\Local\Temp\cknmloy.exe
Size 101KB
SHA256 3b50796d11c0837412a2d9205f28604ef9c02ea436e33f9cb46ac3b99e1bbc37
MD5 80077deafb8ecaf4f3ee72bc61d01132
SHA1 028fef0cbdd7c73e90082ce544e9c988d68a5098
SHA512 7ea525b584bc684a72e75e0e6ba7f125eb1f9d70e16b7125df1b4add3c808fdfec4547cf27ba5f855b57c7a63bbb7ddff7a558c7212c3c031b729281cc7028f0
SSDEEP 3072:ol4uZqBztqXqi24XBkFJ1Og9e0DvZCF/OJ:glZ4MXKWc1Vu/OJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cknmloy.exe

Path C:\Users\Admin\AppData\Local\Temp\cknmloy.exe
Size 101KB
SHA256 3b50796d11c0837412a2d9205f28604ef9c02ea436e33f9cb46ac3b99e1bbc37
MD5 80077deafb8ecaf4f3ee72bc61d01132
SHA1 028fef0cbdd7c73e90082ce544e9c988d68a5098
SHA512 7ea525b584bc684a72e75e0e6ba7f125eb1f9d70e16b7125df1b4add3c808fdfec4547cf27ba5f855b57c7a63bbb7ddff7a558c7212c3c031b729281cc7028f0
SSDEEP 3072:ol4uZqBztqXqi24XBkFJ1Og9e0DvZCF/OJ:glZ4MXKWc1Vu/OJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hmirxzgbs.d

Path C:\Users\Admin\AppData\Local\Temp\hmirxzgbs.d
Size 7KB
SHA256 0f2683f87b2f3a835c8f39c5578ee44f18ee26b1d777cfb3159be4405b6b4314
MD5 349e8343291c12dfc477c8e2c8e84e0d
SHA1 f6d75907ce2d58ea964f2e8b636d62f5a0986bad
SHA512 a04a1e8460802aa8e54f1d8b5849060a5d4bba1ea014a022cb1c456bc7fdcec4a60de598a1594f55dbc59cf3baad5dd1d698cbba2a5a1dc0b3667fb62243440e
SSDEEP 192:darcitQvArWiPvg6b9F+FSYHiL2v6ZLtNI7ypzV:uCYrNPvg8RYp6HNI7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

kfdwcphejh.rb

Path C:\Users\Admin\AppData\Local\Temp\kfdwcphejh.rb
Size 104KB
SHA256 2546049dcd46bf3581e36e0f1b32c393636f33618eb6cb9bd4e52cd23a2e531a
MD5 205964c616a764b7f9c028c2056becad
SHA1 fa7f49ffb59a3049dcc39d25a5d5e588101e0fc4
SHA512 300a004d4812e27d0a0ffc367052165c71ca3d5c112935d8bf9f70cb89e57d98aa43df4f05f51d053649ac8c9dd9f1531e6c0939f3aab2d4b81ac3e1de6ec134
SSDEEP 3072:4MThHrp6gl4JIoh2OSXeW9IG7IwAj7i8rgmqolK:4Adrp6LuohRseW9bAjZPK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2160-139-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2160-140-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download

memory/2160-141-0x00000000058C0000-0x000000000595C000-memory.dmp

Download

memory/2160-142-0x0000000006B90000-0x0000000006D52000-memory.dmp

Download

memory/2160-143-0x0000000006A60000-0x0000000006AF2000-memory.dmp

Download

memory/2160-144-0x0000000006A40000-0x0000000006A4A000-memory.dmp

Download