snakekeylogger | fd36434871eb55ee3d9f78ee0fd63f26c915f8d5a7d3848ef6ffddcac75893cc

General

Target

Cotizacion ##5033900.exe
Size

623KB
MD5

e5e34926801d009fd9345c1221cf61d1
SHA1

00dc97afe9b99f0f4c9c6be374ac0a82958028fd
SHA256

fd36434871eb55ee3d9f78ee0fd63f26c915f8d5a7d3848ef6ffddcac75893cc
SHA512

b7c2d2e7194d2a798abdf6e93f6fd1ded8f01261c35cd474c01684f7a10a791dcbd09625b094c2a8ac2f8b458754f1a8e2e52954de07a187425483b88755df91
SSDEEP

12288:2Wc/bUYIsYolnr8+HrF2pJSlghtqle1De7wubknDIlLS6YfiYh:diXrYoxHrF2pLql2IwubDsa

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.mtbooks.com.mx
Port:
587
Username:
[email protected]
Password:
^QGUcHQjx3

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4148-143-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cotizacion ##5033900.exe
Key opened	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cotizacion ##5033900.exe
Key opened	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cotizacion ##5033900.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
60	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 4148	1608	Cotizacion ##5033900.exe	98

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1608	Cotizacion ##5033900.exe
1608	Cotizacion ##5033900.exe
4148	Cotizacion ##5033900.exe
4148	Cotizacion ##5033900.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4148	Cotizacion ##5033900.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	Cotizacion ##5033900.exe
Token: SeDebugPrivilege	4148	Cotizacion ##5033900.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98
PID 1608 wrote to memory of 4148	1608	Cotizacion ##5033900.exe	98

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cotizacion ##5033900.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cotizacion ##5033900.exe

C:\Users\Admin\AppData\Local\Temp\Cotizacion ##5033900.exe
"C:\Users\Admin\AppData\Local\Temp\Cotizacion ##5033900.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\Cotizacion ##5033900.exe
  "C:\Users\Admin\AppData\Local\Temp\Cotizacion ##5033900.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cotizacion ##5033900.exe.log

Filesize
1KB

MD5
ef17d50720dd489ca8af0a57c493285b

SHA1
455fa3fb2b27069068e132dea6ad680bcbab31ef

SHA256
440cb4751f4cf17bee0e0d1e613ee931ea620307cfbb10e37fc6d8ec268b49b0

SHA512
53833efc1f8e298aadc0ea68edbdd8fa72f0767f695b99dbdde8615665eee279e115f2ab54f7e6a2e591be1efa0d108792e68677dddde300337e09994bb1c07a

Download Submit
memory/1608-141-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/1608-134-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/1608-136-0x00000000055F0000-0x0000000005682000-memory.dmp

Filesize
584KB

Download
memory/1608-137-0x0000000005750000-0x0000000005760000-memory.dmp

Filesize
64KB

Download
memory/1608-138-0x00000000056F0000-0x00000000056FA000-memory.dmp

Filesize
40KB

Download
memory/1608-139-0x00000000071B0000-0x00000000071D2000-memory.dmp

Filesize
136KB

Download
memory/1608-135-0x0000000005AC0000-0x0000000006064000-memory.dmp

Filesize
5.6MB

Download
memory/1608-142-0x0000000005750000-0x0000000005760000-memory.dmp

Filesize
64KB

Download
memory/1608-140-0x0000000007280000-0x000000000731C000-memory.dmp

Filesize
624KB

Download
memory/1608-147-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/1608-133-0x0000000000BA0000-0x0000000000C42000-memory.dmp

Filesize
648KB

Download
memory/4148-143-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4148-146-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/4148-148-0x0000000006A70000-0x0000000006C32000-memory.dmp

Filesize
1.8MB

Download
memory/4148-149-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing