snakekeylogger | 9901b6b09b65e36a881dcebc20d5dffa8e70f1258fefa766566f3e17614d7f08

Analysis

max time kernel
142s
max time network
112s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-03-2023 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New order#2_W43.exe
Size

283KB
MD5

6e039c88706de216f5868b3a5a6907c8
SHA1

059c31716cd028e75825d2424690ae23d16609db
SHA256

9901b6b09b65e36a881dcebc20d5dffa8e70f1258fefa766566f3e17614d7f08
SHA512

040ef1dbc56a57d0e68255207f3370f355d242f5c364039b08d3c2615227a7b6a2479e9d8f88461acadd1be9bc2e67160bbcdaa57a02922d6428d14aba9cfe06
SSDEEP

6144:PYa6OoOx/cjH90btFuGj484hGnyNE8sEz5/3P:PYw/hcjd0JcHnhGYow5X

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/924-68-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/924-72-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/924-73-0x0000000000400000-0x0000000000437000-memory.dmp	family_snakekeylogger
behavioral1/memory/924-74-0x00000000006F0000-0x0000000000716000-memory.dmp	family_snakekeylogger
behavioral1/memory/924-75-0x00000000045C0000-0x0000000004600000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

Processes:

etpujifhk.exeetpujifhk.exe

pid process

1696 etpujifhk.exe
924 etpujifhk.exe
Loads dropped DLL 3 IoCs

Processes:

New order#2_W43.exeetpujifhk.exe

pid process

1708 New order#2_W43.exe
1708 New order#2_W43.exe
1696 etpujifhk.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1696	etpujifhk.exe
924	etpujifhk.exe

pid	process
1708	New order#2_W43.exe
1708	New order#2_W43.exe
1696	etpujifhk.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

etpujifhk.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	etpujifhk.exe
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	etpujifhk.exe
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	etpujifhk.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

etpujifhk.exe

description pid process target process

PID 1696 set thread context of 924 1696 etpujifhk.exe etpujifhk.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

etpujifhk.exe

pid process

924 etpujifhk.exe
924 etpujifhk.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

etpujifhk.exe

pid process

1696 etpujifhk.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

etpujifhk.exe

description pid process

Token: SeDebugPrivilege 924 etpujifhk.exe

flow	ioc
3	checkip.dyndns.org

description	pid	process	target process
PID 1696 set thread context of 924	1696	etpujifhk.exe	etpujifhk.exe

pid	process
924	etpujifhk.exe
924	etpujifhk.exe

pid	process
1696	etpujifhk.exe

description	pid	process
Token: SeDebugPrivilege	924	etpujifhk.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

New order#2_W43.exeetpujifhk.exe

description	pid	process	target process
PID 1708 wrote to memory of 1696	1708	New order#2_W43.exe	etpujifhk.exe
PID 1708 wrote to memory of 1696	1708	New order#2_W43.exe	etpujifhk.exe
PID 1708 wrote to memory of 1696	1708	New order#2_W43.exe	etpujifhk.exe
PID 1708 wrote to memory of 1696	1708	New order#2_W43.exe	etpujifhk.exe
PID 1696 wrote to memory of 924	1696	etpujifhk.exe	etpujifhk.exe
PID 1696 wrote to memory of 924	1696	etpujifhk.exe	etpujifhk.exe
PID 1696 wrote to memory of 924	1696	etpujifhk.exe	etpujifhk.exe
PID 1696 wrote to memory of 924	1696	etpujifhk.exe	etpujifhk.exe
PID 1696 wrote to memory of 924	1696	etpujifhk.exe	etpujifhk.exe

outlook_office_path 1 IoCs

Processes:

etpujifhk.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	etpujifhk.exe

outlook_win_path 1 IoCs

Processes:

etpujifhk.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	etpujifhk.exe

C:\Users\Admin\AppData\Local\Temp\New order#2_W43.exe
"C:\Users\Admin\AppData\Local\Temp\New order#2_W43.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe
"C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe" C:\Users\Admin\AppData\Local\Temp\bhtvqfm.dh
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe
"C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bhtvqfm.dh
Filesize
5KB

MD5
a76713e62a44962a44f9f3592966389e

SHA1
9f2065531ba6e597879658bafe1a862ef6836600

SHA256
5a7636e7f4127d968665591290b937529a88ce610a862a1d304b58fda1ef8e43

SHA512
023dbdad19a1682a6eac3120d8fc201ed8e1a3fc4a9c2046eb617dc146564567e908b7de6473c78c30bc1a3d01e927cafdee25bf2ad301e41809cf3e7720622c

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tudykootswg.gfx
Filesize
225KB

MD5
1c4aaf2ed0d55ad70d4a4072b9473843

SHA1
fcbbf98d57c7a55ae80320f8377bead9a54c284d

SHA256
0a2ee718a9bd8fdff7b10baf4ac0b3dc269b93da840f3fb0e037e34aacfb717f

SHA512
d6dbf2806f90fd43bb30193c0988c81ba4ff298ba653a3072a6270d24626db9f4ba3159d8c0676f1008bc8a49885c856ccbddafeb083627f9456bf15800c0037

Download Submit
\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
\Users\Admin\AppData\Local\Temp\etpujifhk.exe
Filesize
138KB

MD5
3f5f31ed34c36492955c38f3bbaca512

SHA1
6e70ae1d2b245250c110c9b39852759113d263b5

SHA256
d387cec4f9e97606c787e2d071d22f94ee604d1a8229b7244364f782ed1c1c37

SHA512
d135dc30488279b6246cf95e039355f66bc71ab8a990781b53b8ec850a9055b45eb0976024064ee73e6e08efee2c4f78f37da8f5085a6a35f7bab32c38e1de8d

Download Submit
memory/924-68-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/924-72-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/924-73-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/924-74-0x00000000006F0000-0x0000000000716000-memory.dmp

Filesize
152KB

Download
memory/924-75-0x00000000045C0000-0x0000000004600000-memory.dmp

Filesize
256KB

Download
memory/924-76-0x00000000045C0000-0x0000000004600000-memory.dmp

Filesize
256KB

Download
memory/924-78-0x00000000045C0000-0x0000000004600000-memory.dmp

Filesize
256KB

Download