snakekeylogger | af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6

Analysis

max time kernel
31s
max time network
111s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15/03/2023, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FEDEX - 2716436747964836.exe
Size 256KB
Sample230315-2rnmsaaa4s
SHA256 af4962cafb502e71cf0e5c22dd57db11b6bfd380448f1fc2c9b2f1adcb5f47e6
MD5 7ec2931770c7f4965a1428a637c20ac5
SHA1 38aeb36b3f31aa8f4c08ecfd6b7c695297535160
SHA512 111354033005174ff0fb1490c057be9a4dd7a8367da75f75a792dd50e534580b6d4a09260419b196ca5b563c5faf2ad88dd3a9410e761149eb5faba7bad9c497
SSDEEP 6144:PYa6tVqxrPTiFxabi2tSRljOwqtrr8Y6+20eatd3X8jFDgFIi8:PYXVqxLUkbSjOTp6+20z8jFM+h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6166695280:AAFYAmHtNxka4VVDE564YnB1MkmT68AnzXY/sendMessage?chat_id=5981442240

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 4 IoCs

resource	yara_rule
behavioral1/memory/1916-69-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/1916-73-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/1916-74-0x00000000002C0000-0x00000000002E6000-memory.dmp	family_snakekeylogger
behavioral1/memory/1916-75-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1552	nkqpbn.exe
1916	nkqpbn.exe

Loads dropped DLL 3 IoCs

pid	Process
1676	FEDEX - 2716436747964836.exe
1676	FEDEX - 2716436747964836.exe
1552	nkqpbn.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nkqpbn.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nkqpbn.exe
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nkqpbn.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 1916	1552	nkqpbn.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1916	nkqpbn.exe
1916	nkqpbn.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1552	nkqpbn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	nkqpbn.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1552	1676	FEDEX - 2716436747964836.exe	28
PID 1676 wrote to memory of 1552	1676	FEDEX - 2716436747964836.exe	28
PID 1676 wrote to memory of 1552	1676	FEDEX - 2716436747964836.exe	28
PID 1676 wrote to memory of 1552	1676	FEDEX - 2716436747964836.exe	28
PID 1552 wrote to memory of 1916	1552	nkqpbn.exe	29
PID 1552 wrote to memory of 1916	1552	nkqpbn.exe	29
PID 1552 wrote to memory of 1916	1552	nkqpbn.exe	29
PID 1552 wrote to memory of 1916	1552	nkqpbn.exe	29
PID 1552 wrote to memory of 1916	1552	nkqpbn.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nkqpbn.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	nkqpbn.exe

C:\Users\Admin\AppData\Local\Temp\FEDEX - 2716436747964836.exe
"C:\Users\Admin\AppData\Local\Temp\FEDEX - 2716436747964836.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe
  "C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe" C:\Users\Admin\AppData\Local\Temp\zrfsjy.gui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe
    "C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:1916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kyqxwbxje.vza

Path C:\Users\Admin\AppData\Local\Temp\kyqxwbxje.vza
Size 226KB
SHA256 67154cccc4aad51b2f759b3942942d848856940737f93bf2d7c586c61503cbe1
MD5 82257214c89a36daadb29f434d6b595e
SHA1 5e081e55da830a145c6a5d8914aa661d15053f7b
SHA512 0eb6e76e8dea9e602837a14e140059994e1ea1e254918629aa0b640dc2750aaa5f3ea0db9f37d5be90d6cbd7400ffee84c8083e8d718e140542cbbffa5d22127
SSDEEP 6144:AxIZEwhME9oNVCOQecabcqkN1VMWjHdQ3syZnYabx:yE5MsCCXecQcqkDD+3JYux
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path C:\Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

zrfsjy.gui

Path C:\Users\Admin\AppData\Local\Temp\zrfsjy.gui
Size 5KB
SHA256 75c13ba71fee1af4cd25d6fba59ae70e474311944e4f1aa2c4908946642a17d6
MD5 2fe16b6addb9f6af8b29d1d12520abde
SHA1 9e7919e47af38e2b92a0d18d4a10e4946007ffa1
SHA512 1e6ebd3f8089018574a098fd3b11d16c96a1a108a560a5ab7985038c7e72f4dcf43ac29dd0322d3ab51661855c3f34eb269fba819352c2f5e297f28b4a4ff61b
SSDEEP 96:Farc6oYeg/DrYuik2XO5oSws3uxcWT2kNiY2mPyQqyKv6L0LtNI7ypzs6:FarcRaqhX1Sh3JM2xL5v64LtNI7ypzV
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path \Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path \Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

nkqpbn.exe

Path \Users\Admin\AppData\Local\Temp\nkqpbn.exe
Size 58KB
SHA256 d61e3b80be2b3dd10e867e1e5933c94810a06dfb2cf501af7f5896a2d92d72df
MD5 688f38252269199c7b806b74bd18e4d2
SHA1 5a922ecb3c1519d5ded4c6d78b421b397eb706e8
SHA512 2667ad20374090faa9970736adb1f102749cc0f25c75ef82be98dab2ca178683ce984f6ceca3a0e4116281644e0dbf18032d7e2d00b6aa1d5904acbe4b0fb82b
SSDEEP 768:Cpbnyq696YM4+FJV/dRuDh96ir6VhAkAXuabEoK3r412IGXM5x8dsr:CpbRrYSJV/ToZr6VhhAXj7GnI15is
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1916-69-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1916-73-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1916-74-0x00000000002C0000-0x00000000002E6000-memory.dmp

Download

memory/1916-75-0x0000000000400000-0x0000000000437000-memory.dmp

Download

memory/1916-76-0x0000000004B50000-0x0000000004B90000-memory.dmp

Download

memory/1916-77-0x0000000004B50000-0x0000000004B90000-memory.dmp

Download

memory/1916-78-0x0000000004B50000-0x0000000004B90000-memory.dmp

Download