snakekeylogger | 9ce6334520ddf82976f7a4b77620e56e6504e1f1c5f871d8f46d277e1ed7ebed

Analysis

max time kernel
135s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2023, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hesaphareketi-01.PDF.exe
Size 234KB
Sample230306-s3l4nada97
SHA256 9ce6334520ddf82976f7a4b77620e56e6504e1f1c5f871d8f46d277e1ed7ebed
MD5 60197b1773af2ab7bfcc2846fbead5d9
SHA1 66d413de0b69ead7ae91d72b63b108319b8426bb
SHA512 9e53368ecd18bdc73bac89ada39b2693a4c6e6a7d7b87c8bbcc3067bf0584b76cdc282afee9778ba0bb48f2f72b39c091f3150414630aa4dc786ca508ccf2521
SSDEEP 3072:FfY/TU9fE9PEtuPxbYPB9TV/dYRej4UTHd4uv8+QzLrWvYfYKQtO7Tm2u/FTC5x4:JYa6R1YPxlrNY/rHM2T+tTC/LYSaiiOS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger persistence stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral2/memory/1760-143-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral2/memory/1760-145-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral2/memory/1760-146-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral2/memory/1760-149-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral2/memory/1760-152-0x0000000004EB0000-0x0000000004EC0000-memory.dmp	family_snakekeylogger
behavioral2/memory/1760-153-0x0000000004EB0000-0x0000000004EC0000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1152	dqkcdexsd.exe
1760	dqkcdexsd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jfoktxhq = "C:\\Users\\Admin\\AppData\\Roaming\\btpy\\tdmrbwgcluqa.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dqkcdexsd.exe\" C:\\Users\\Admin\\AppData\\Loca"	dqkcdexsd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 1760	1152	dqkcdexsd.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	1760	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	dqkcdexsd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1152	dqkcdexsd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	dqkcdexsd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1152	4728	hesaphareketi-01.PDF.exe	85
PID 4728 wrote to memory of 1152	4728	hesaphareketi-01.PDF.exe	85
PID 4728 wrote to memory of 1152	4728	hesaphareketi-01.PDF.exe	85
PID 1152 wrote to memory of 1760	1152	dqkcdexsd.exe	86
PID 1152 wrote to memory of 1760	1152	dqkcdexsd.exe	86
PID 1152 wrote to memory of 1760	1152	dqkcdexsd.exe	86
PID 1152 wrote to memory of 1760	1152	dqkcdexsd.exe	86

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.PDF.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe
  "C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe" C:\Users\Admin\AppData\Local\Temp\yxvkoz.d
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe
    "C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1384
      4⤵
      Program crash
      PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1760 -ip 1760
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dqkcdexsd.exe

Path C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe
Size 8KB
SHA256 5c502083dfd690e358778a4102e5e800ed7223722b1451794188ac37ac90d728
MD5 72a91dd7e965572d2e20c8c58585ca8d
SHA1 ccfc57252feb4076e052393f4f379f00978b9d35
SHA512 1c18deb28dcf253a4f18f831d98e2001311819971ee6898ead13983a89065c0337db0164c68b5df07724412c900c05883fcc44d16d163ea79cbda390071f045f
SSDEEP 96:BwHncXFci21eyZxrOflYfGKWAuLTaFmfKALuewj/xRrTiH9:aHVjrk7AuL+FwKAAj/XvC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dqkcdexsd.exe

Path C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe
Size 8KB
SHA256 5c502083dfd690e358778a4102e5e800ed7223722b1451794188ac37ac90d728
MD5 72a91dd7e965572d2e20c8c58585ca8d
SHA1 ccfc57252feb4076e052393f4f379f00978b9d35
SHA512 1c18deb28dcf253a4f18f831d98e2001311819971ee6898ead13983a89065c0337db0164c68b5df07724412c900c05883fcc44d16d163ea79cbda390071f045f
SSDEEP 96:BwHncXFci21eyZxrOflYfGKWAuLTaFmfKALuewj/xRrTiH9:aHVjrk7AuL+FwKAAj/XvC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

dqkcdexsd.exe

Path C:\Users\Admin\AppData\Local\Temp\dqkcdexsd.exe
Size 8KB
SHA256 5c502083dfd690e358778a4102e5e800ed7223722b1451794188ac37ac90d728
MD5 72a91dd7e965572d2e20c8c58585ca8d
SHA1 ccfc57252feb4076e052393f4f379f00978b9d35
SHA512 1c18deb28dcf253a4f18f831d98e2001311819971ee6898ead13983a89065c0337db0164c68b5df07724412c900c05883fcc44d16d163ea79cbda390071f045f
SSDEEP 96:BwHncXFci21eyZxrOflYfGKWAuLTaFmfKALuewj/xRrTiH9:aHVjrk7AuL+FwKAAj/XvC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ipblzzz.kkw

Path C:\Users\Admin\AppData\Local\Temp\ipblzzz.kkw
Size 225KB
SHA256 56cd5fd6a1905012234a543ef99567525d71f0a82ad8f1bb1eb9bfcbaa0252a0
MD5 cd6724f5e2b096559aa856dae9916449
SHA1 f2c8e8866712e49a1265a1ce9f3dc2eb1c26b4d2
SHA512 6fcc95280732b48c140605c033d57f4af9c473d45376c27cc67d4f12505ba48f9cde1375662210e057313aee511b859a7ea42fc608272ede37b6944ce23c0cb0
SSDEEP 6144:LBkobBLEL0/Y4l19mm2VJc1ntwpGttj1sccwax5:LBfFEw/7l+m23snD1B/25
MD5 SHA1 SHA512 SSDEEP

Submit Download

yxvkoz.d

Path C:\Users\Admin\AppData\Local\Temp\yxvkoz.d
Size 7KB
SHA256 f2eae2162c354d66635966545e39b8be3859bf08d29ab37397d7a8cb499ead8c
MD5 2d93f3e939fb7ebd62e507802d0aff03
SHA1 e63215644cae37460e4dee974148a86090fd7735
SHA512 d2af4971a30b67362dac1ce81bf253855c214989ed992e9b76a32ac0a19f16093c93fb5d6905766ae7cae7da89e9d6490bc8a3b45f0ccfd519ddbbe741efed65
SSDEEP 192:darcitQvArWiPvwMb9ROusDfGsuttOVDJIxjgH1cemSBQiF:uCYrNPvwOzsDOiJIxjj6Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1760-145-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1760-143-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1760-146-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1760-148-0x0000000005470000-0x0000000005A14000-memory.dmp

Download

memory/1760-149-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1760-151-0x0000000004F60000-0x0000000004FFC000-memory.dmp

Download

memory/1760-152-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/1760-153-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/1760-150-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download

memory/1760-154-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Download