snakekeylogger | 3355b6fac696f3aad246fd34404a407dd9a7945f540537ec695bb1cb75c337c0

General

Target

INV-00289202.exe
Size

289KB
MD5

5a1cdfd26e4afd8433348e47b287882c
SHA1

af031bb897a71ce50907c77e2fc7518c60c80598
SHA256

3355b6fac696f3aad246fd34404a407dd9a7945f540537ec695bb1cb75c337c0
SHA512

009d9eba87e13a9b4db8ee043dbc3ac3565add30a86b7b926b911a773d6d2817a9525e9fceb5b6e330b849ebf1a0f22fb992b58a111e5833224e57ac375b853c
SSDEEP

6144:bYa6/lP1OjJvVJMdhINFE/MWfwfQJwwxCNfqp+a0meiesqRIvVzcc:bYllPkjVVOdhINFBk1wobvMoD

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2060-142-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/2060-144-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/2060-145-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/2060-149-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/2060-152-0x0000000004B00000-0x0000000004B10000-memory.dmp	family_snakekeylogger
behavioral2/memory/2060-160-0x0000000004B00000-0x0000000004B10000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

Processes:

llsyrx.exellsyrx.exe

pid process

5064 llsyrx.exe
2060 llsyrx.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
5064	llsyrx.exe
2060	llsyrx.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

llsyrx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	llsyrx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	llsyrx.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	llsyrx.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

llsyrx.exe

description pid process target process

PID 5064 set thread context of 2060 5064 llsyrx.exe llsyrx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

llsyrx.exe

pid process

2060 llsyrx.exe
2060 llsyrx.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

llsyrx.exe

pid process

5064 llsyrx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

llsyrx.exe

description pid process

Token: SeDebugPrivilege 2060 llsyrx.exe

flow	ioc
23	checkip.dyndns.org

description	pid	process	target process
PID 5064 set thread context of 2060	5064	llsyrx.exe	llsyrx.exe

pid	process
2060	llsyrx.exe
2060	llsyrx.exe

pid	process
5064	llsyrx.exe

description	pid	process
Token: SeDebugPrivilege	2060	llsyrx.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

INV-00289202.exellsyrx.exe

description	pid	process	target process
PID 2984 wrote to memory of 5064	2984	INV-00289202.exe	llsyrx.exe
PID 2984 wrote to memory of 5064	2984	INV-00289202.exe	llsyrx.exe
PID 2984 wrote to memory of 5064	2984	INV-00289202.exe	llsyrx.exe
PID 5064 wrote to memory of 2060	5064	llsyrx.exe	llsyrx.exe
PID 5064 wrote to memory of 2060	5064	llsyrx.exe	llsyrx.exe
PID 5064 wrote to memory of 2060	5064	llsyrx.exe	llsyrx.exe
PID 5064 wrote to memory of 2060	5064	llsyrx.exe	llsyrx.exe

outlook_office_path 1 IoCs

Processes:

llsyrx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	llsyrx.exe

outlook_win_path 1 IoCs

Processes:

llsyrx.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	llsyrx.exe

C:\Users\Admin\AppData\Local\Temp\INV-00289202.exe
"C:\Users\Admin\AppData\Local\Temp\INV-00289202.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\llsyrx.exe
"C:\Users\Admin\AppData\Local\Temp\llsyrx.exe" C:\Users\Admin\AppData\Local\Temp\syabbjj.fm
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5064

C:\Users\Admin\AppData\Local\Temp\llsyrx.exe
"C:\Users\Admin\AppData\Local\Temp\llsyrx.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2060

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\llsyrx.exe
Filesize
138KB

MD5
a7c9cd6c62a1716ca58e806e54f18334

SHA1
540709b7a784fa31fcfd97a8d32a1963b30c3242

SHA256
868d13f01ede10827e66bd49d0ebc7c674d9d860e735660c928358ab48106ccc

SHA512
58828ed658ffc4b2a9015924b691d326c5d3d4f61872b2619f84f6db8e53be6d43c79dd97adf87e6fbd108341d0933c934ab5338b9b0f1689b968e4a6d119843

Download Submit
C:\Users\Admin\AppData\Local\Temp\llsyrx.exe
Filesize
138KB

MD5
a7c9cd6c62a1716ca58e806e54f18334

SHA1
540709b7a784fa31fcfd97a8d32a1963b30c3242

SHA256
868d13f01ede10827e66bd49d0ebc7c674d9d860e735660c928358ab48106ccc

SHA512
58828ed658ffc4b2a9015924b691d326c5d3d4f61872b2619f84f6db8e53be6d43c79dd97adf87e6fbd108341d0933c934ab5338b9b0f1689b968e4a6d119843

Download Submit
C:\Users\Admin\AppData\Local\Temp\llsyrx.exe
Filesize
138KB

MD5
a7c9cd6c62a1716ca58e806e54f18334

SHA1
540709b7a784fa31fcfd97a8d32a1963b30c3242

SHA256
868d13f01ede10827e66bd49d0ebc7c674d9d860e735660c928358ab48106ccc

SHA512
58828ed658ffc4b2a9015924b691d326c5d3d4f61872b2619f84f6db8e53be6d43c79dd97adf87e6fbd108341d0933c934ab5338b9b0f1689b968e4a6d119843

Download Submit
C:\Users\Admin\AppData\Local\Temp\syabbjj.fm
Filesize
5KB

MD5
8a49f75711617c9657c9f69f795784f0

SHA1
00883fd16d7c680e2658c67ea23a2bf362372d1b

SHA256
5f6647195b9cba4d3d285b35a27d185d0713fd7a0a1461486bddf45fd232d460

SHA512
885853147fc0e3a8a06d677dd6b886e69cacf19abe05b8af96c8b836a4b853b456c0b120d4788b59f20cac5745d649d22e9c55834eef25c3a822c96921b3dd95

Download Submit
C:\Users\Admin\AppData\Local\Temp\tbakozui.jq
Filesize
226KB

MD5
13deb5507252ac98885321d334de8e7b

SHA1
4c424346c8fa251dbe7280597f9dcada68d59835

SHA256
26589136a1a4510c48249bd40c77e6ddb8abf3349123acaab72d1a3aee123ab4

SHA512
3d6547ebcbc72a2f8e18a3e210f1cbc1ebc424fbb68c22b03c4808a53b4f8647eafb315e5745825e7c372f8ec93e260db281442da06304f511dad9f6b38b0668

Download Submit
memory/2060-148-0x0000000004980000-0x0000000004A1C000-memory.dmp

Filesize
624KB

Download
memory/2060-156-0x0000000005F10000-0x0000000005F1A000-memory.dmp

Filesize
40KB

Download
memory/2060-142-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2060-145-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2060-147-0x0000000004B10000-0x00000000050B4000-memory.dmp

Filesize
5.6MB

Download
memory/2060-161-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-149-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2060-151-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-150-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-152-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-153-0x0000000005B10000-0x0000000005BA2000-memory.dmp

Filesize
584KB

Download
memory/2060-154-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-155-0x0000000005C50000-0x0000000005E12000-memory.dmp

Filesize
1.8MB

Download
memory/2060-144-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/2060-158-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-159-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/2060-160-0x0000000004B00000-0x0000000004B10000-memory.dmp

Filesize
64KB

Download
memory/5064-140-0x00000000005B0000-0x00000000005B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads