snakekeylogger | da9c7594ee8e00c5aa90ad018bc069e8f9504fdaa542813c336ddfbdafbd26e1

General

Target

Ramona voy 2022003.exe
Size

778KB
MD5

157faf8466b89969ccf5c66a38750c65
SHA1

381c0c689059fbdeb1b361d556581a383e3fb293
SHA256

da9c7594ee8e00c5aa90ad018bc069e8f9504fdaa542813c336ddfbdafbd26e1
SHA512

e84f6b9f51dfdce87028610b9a87aedcc9d63374ddbef2e8dd4fec6b27e624c6333b7df97347b60210eafbb1f27f24e552a4dfa7790cffcea2b8a8a3db315f3d
SSDEEP

24576:LMgkoHlWxMiQW/O4ue7XeT8FrM4JvbTwmj:tFlYMiQWmS7O4MOv/B

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
argona.ro
Port:
26
Username:
dan.grama@argona.ro
Password:
Argona12!@
Email To:
trainee@valleycountysar.org

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1628-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1628-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1628-73-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1628-75-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1628-77-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/560-78-0x0000000002680000-0x00000000026C0000-memory.dmp	family_snakekeylogger
behavioral1/memory/560-80-0x0000000002680000-0x00000000026C0000-memory.dmp	family_snakekeylogger

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Ramona voy 2022003.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ramona voy 2022003.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ramona voy 2022003.exe
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ramona voy 2022003.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ramona voy 2022003.exe

description pid process target process

PID 2032 set thread context of 1628 2032 Ramona voy 2022003.exe Ramona voy 2022003.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

268 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Ramona voy 2022003.exeRamona voy 2022003.exepowershell.exe

pid process

2032 Ramona voy 2022003.exe
2032 Ramona voy 2022003.exe
1628 Ramona voy 2022003.exe
560 powershell.exe
1628 Ramona voy 2022003.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 2032 set thread context of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe

pid	process
268	schtasks.exe

pid	process
2032	Ramona voy 2022003.exe
2032	Ramona voy 2022003.exe
1628	Ramona voy 2022003.exe
560	powershell.exe
1628	Ramona voy 2022003.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Ramona voy 2022003.exeRamona voy 2022003.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2032	Ramona voy 2022003.exe
Token: SeDebugPrivilege	1628	Ramona voy 2022003.exe
Token: SeDebugPrivilege	560	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Ramona voy 2022003.exe

description	pid	process	target process
PID 2032 wrote to memory of 560	2032	Ramona voy 2022003.exe	powershell.exe
PID 2032 wrote to memory of 560	2032	Ramona voy 2022003.exe	powershell.exe
PID 2032 wrote to memory of 560	2032	Ramona voy 2022003.exe	powershell.exe
PID 2032 wrote to memory of 560	2032	Ramona voy 2022003.exe	powershell.exe
PID 2032 wrote to memory of 268	2032	Ramona voy 2022003.exe	schtasks.exe
PID 2032 wrote to memory of 268	2032	Ramona voy 2022003.exe	schtasks.exe
PID 2032 wrote to memory of 268	2032	Ramona voy 2022003.exe	schtasks.exe
PID 2032 wrote to memory of 268	2032	Ramona voy 2022003.exe	schtasks.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe
PID 2032 wrote to memory of 1628	2032	Ramona voy 2022003.exe	Ramona voy 2022003.exe

outlook_office_path 1 IoCs

Processes:

Ramona voy 2022003.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ramona voy 2022003.exe

outlook_win_path 1 IoCs

Processes:

Ramona voy 2022003.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Ramona voy 2022003.exe

C:\Users\Admin\AppData\Local\Temp\Ramona voy 2022003.exe
"C:\Users\Admin\AppData\Local\Temp\Ramona voy 2022003.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IYOfCCiK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IYOfCCiK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4664.tmp"
2⤵
- Creates scheduled task(s)
PID:268

C:\Users\Admin\AppData\Local\Temp\Ramona voy 2022003.exe
"C:\Users\Admin\AppData\Local\Temp\Ramona voy 2022003.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4664.tmp
Filesize
1KB

MD5
ce4248b6f12357f6df54e37c6839d8cb

SHA1
9b62310300cc3dca95f6949c047b548794769e39

SHA256
cac338ab49a9bc4e613b3e9591273c9f4706080f2fdeb7d7a769d7df01673025

SHA512
54db58e1da36269a766d82a3f8c830b106854319f5723cc6694313fd058b1930b745df03cb76391a2416462df0defef6e78daa6dcf474fd7ea8d6da25a7c89a5

Download Submit
memory/560-80-0x0000000002680000-0x00000000026C0000-memory.dmp

Filesize
256KB

Download
memory/560-78-0x0000000002680000-0x00000000026C0000-memory.dmp

Filesize
256KB

Download
memory/1628-77-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1628-81-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/1628-79-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/1628-75-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-71-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-73-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2032-58-0x0000000000510000-0x000000000051C000-memory.dmp

Filesize
48KB

Download
memory/2032-65-0x00000000050E0000-0x0000000005108000-memory.dmp

Filesize
160KB

Download
memory/2032-54-0x0000000000980000-0x0000000000A48000-memory.dmp

Filesize
800KB

Download
memory/2032-56-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/2032-57-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download
memory/2032-55-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download
memory/2032-59-0x0000000005C40000-0x0000000005CA2000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads