snakekeylogger | 063673e920d3daadc423a330055f7ed85d270311c5ef7f812e2f70dbdec562a7

Analysis

max time kernel
27s
max time network
114s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/03/2023, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ARRIVAL NOTICE.exe
Size

255KB
MD5

1473152426b25dc4d23b1ed6e8fbcc11
SHA1

246061e73e8f99b214d8fe5934f33abbbfde3a02
SHA256

063673e920d3daadc423a330055f7ed85d270311c5ef7f812e2f70dbdec562a7
SHA512

e15862ef1c99bdc6a6212adfe5a5de278b8221cc7ec0c45354a70e14980082250d380fe3a808b69261ef1e8d3c9647aa3412294bbeef00579db144ec710d51a9
SSDEEP

6144:/Ya6bOAbLzPXVFfarWQeC57Puvu4etjp3VzY7J0ZVU:/Y5OuLTVFyrWtquvuLlk0c

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6041013494:AAH-I-5N7YCs5dQrpIdJ8toHohqsTM_GsfI/sendMessage?chat_id=6291600401

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 4 IoCs

resource	yara_rule
behavioral1/memory/652-73-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/652-76-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/652-78-0x00000000004B0000-0x00000000004D6000-memory.dmp	family_snakekeylogger
behavioral1/memory/652-79-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger

Executes dropped EXE 4 IoCs

pid	Process
2028	jhqtsditx.exe
640	jhqtsditx.exe
680	jhqtsditx.exe
652	jhqtsditx.exe

Loads dropped DLL 5 IoCs

pid	Process
1100	ARRIVAL NOTICE.exe
1100	ARRIVAL NOTICE.exe
2028	jhqtsditx.exe
2028	jhqtsditx.exe
2028	jhqtsditx.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jhqtsditx.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jhqtsditx.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jhqtsditx.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2028 set thread context of 652	2028	jhqtsditx.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
652	jhqtsditx.exe
652	jhqtsditx.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2028	jhqtsditx.exe
2028	jhqtsditx.exe
2028	jhqtsditx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	652	jhqtsditx.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 2028	1100	ARRIVAL NOTICE.exe	26
PID 1100 wrote to memory of 2028	1100	ARRIVAL NOTICE.exe	26
PID 1100 wrote to memory of 2028	1100	ARRIVAL NOTICE.exe	26
PID 1100 wrote to memory of 2028	1100	ARRIVAL NOTICE.exe	26
PID 2028 wrote to memory of 640	2028	jhqtsditx.exe	27
PID 2028 wrote to memory of 640	2028	jhqtsditx.exe	27
PID 2028 wrote to memory of 640	2028	jhqtsditx.exe	27
PID 2028 wrote to memory of 640	2028	jhqtsditx.exe	27
PID 2028 wrote to memory of 680	2028	jhqtsditx.exe	28
PID 2028 wrote to memory of 680	2028	jhqtsditx.exe	28
PID 2028 wrote to memory of 680	2028	jhqtsditx.exe	28
PID 2028 wrote to memory of 680	2028	jhqtsditx.exe	28
PID 2028 wrote to memory of 652	2028	jhqtsditx.exe	29
PID 2028 wrote to memory of 652	2028	jhqtsditx.exe	29
PID 2028 wrote to memory of 652	2028	jhqtsditx.exe	29
PID 2028 wrote to memory of 652	2028	jhqtsditx.exe	29
PID 2028 wrote to memory of 652	2028	jhqtsditx.exe	29

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jhqtsditx.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jhqtsditx.exe

C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE.exe
"C:\Users\Admin\AppData\Local\Temp\ARRIVAL NOTICE.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe
  "C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe" C:\Users\Admin\AppData\Local\Temp\qdvza.c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe
    "C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe"
    3⤵
    - Executes dropped EXE
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe
    "C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe"
    3⤵
    - Executes dropped EXE
    PID:680
- - C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe
    "C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jfbezhjko.n

Filesize
225KB

MD5
daf32291bd0a4d78691b67efabe12611

SHA1
97dd0e0c2ac663437c87081ccdfc4c32eb211409

SHA256
9335d683a4700764897c9be20b86c3eed46bc5c1079432ebd33d439afb02696a

SHA512
b3d52e26959345c8fc74b8c8e365b1e79914546a06f0d9fc35e662c8aecf5c1419b77f45b0608dc718fc959f0dfdcc7d04d2a146cb8c2f10c80379abbfba6691

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\qdvza.c

Filesize
5KB

MD5
e3cd638a65fc0e81d467e09a2665dea8

SHA1
36a092dc0909900bba4180a19d7b5bcc32c84bd8

SHA256
805739f196a0557bcb47bf7761fc671d7b9fe1ca7f2d74289f77d8f240de3689

SHA512
0532622c9662d858e7f4b9874700f41c663d6fe72abd34ce4e6519425c3533aa81c3561e74c21df25002aed255f1e1f0435e8b297140921ea1b3cdec207390fc

Download Submit
\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
\Users\Admin\AppData\Local\Temp\jhqtsditx.exe

Filesize
58KB

MD5
8d648bc1e99f4365bf69bc92cf5464bc

SHA1
e627ffdcd6f624703d0f98e1ae583acd1be72aed

SHA256
6974c6e584acf8a1b7b08e2dde958e3d4b5b1ce76b4f188248d8e11337fa7038

SHA512
02d91d74bf58a3a5965b4eee520af550c88af529648aad5f4be2e79c836a27d542c3323c7c83606993465eac04dd0421abd30608f9d134f01db2dce80b9f7aeb

Download Submit
memory/652-73-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/652-76-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/652-78-0x00000000004B0000-0x00000000004D6000-memory.dmp

Filesize
152KB

Download
memory/652-80-0x00000000049E0000-0x0000000004A20000-memory.dmp

Filesize
256KB

Download
memory/652-79-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download