snakekeylogger | 871cd25c5a71371cf9d6cec80d9f08f191f06a228e6eb0890e0f284277559a92

General

Target

Remesas Aceptadas.exe
Size

580KB
MD5

65356dd18822c4dea40af821d5a3e8e5
SHA1

5e7c5da4d94e29bc55a160788c0a76ae0b139406
SHA256

871cd25c5a71371cf9d6cec80d9f08f191f06a228e6eb0890e0f284277559a92
SHA512

e17e6f8cec423cee62b747283fa64decb0cbdafede0fcbe9833c38ba1b86b2f988b054c87990309d4cb11dd4b61b3889e96a528f9890e23d360066bd46ced163
SSDEEP

12288:WAfDuHOXasG61aezZW3YQEuarwlSiwdFFZG7se31x3ocnS00I2BbJDPhE:WgpraeoIxuaMlFwvH6GHE

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.smartgreenzone.com
Port:
587
Username:
[email protected]
Password:
Smart&Smart123
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

resource	yara_rule
behavioral1/memory/3008-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3008-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3008-21-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3008-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3008-25-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Remesas Aceptadas.exe
Key opened	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Remesas Aceptadas.exe
Key opened	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Remesas Aceptadas.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 3008	2548	Remesas Aceptadas.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2548	Remesas Aceptadas.exe
2548	Remesas Aceptadas.exe
3008	Remesas Aceptadas.exe
2712	powershell.exe
3008	Remesas Aceptadas.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3008	Remesas Aceptadas.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	Remesas Aceptadas.exe
Token: SeDebugPrivilege	3008	Remesas Aceptadas.exe
Token: SeDebugPrivilege	2712	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2712	2548	Remesas Aceptadas.exe	30
PID 2548 wrote to memory of 2712	2548	Remesas Aceptadas.exe	30
PID 2548 wrote to memory of 2712	2548	Remesas Aceptadas.exe	30
PID 2548 wrote to memory of 2712	2548	Remesas Aceptadas.exe	30
PID 2548 wrote to memory of 364	2548	Remesas Aceptadas.exe	32
PID 2548 wrote to memory of 364	2548	Remesas Aceptadas.exe	32
PID 2548 wrote to memory of 364	2548	Remesas Aceptadas.exe	32
PID 2548 wrote to memory of 364	2548	Remesas Aceptadas.exe	32
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34
PID 2548 wrote to memory of 3008	2548	Remesas Aceptadas.exe	34

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Remesas Aceptadas.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Remesas Aceptadas.exe

C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas.exe
"C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rrxwteJq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrxwteJq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5042.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:364
- C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas.exe
  "C:\Users\Admin\AppData\Local\Temp\Remesas Aceptadas.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5042.tmp

Filesize
1KB

MD5
8e85b06b55e5a331269ab23c0c2bd979

SHA1
ac9b1d4c2ba046c340ea24284855e0fca2a06880

SHA256
b48a0508111c39121173c53a78bb691f5d279380d67a0c03ea47de48c0bc1cca

SHA512
6c04d161ca30ec16b26be84ccc4c424296214259675337f755cb18f4c6b0567be57e02c1029f5baccb12ccfdfa0901e2b3569e911f1d4f6768b6b7e6d2776030

Download Submit
memory/2548-26-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-1-0x0000000010470000-0x0000000010508000-memory.dmp

Filesize
608KB

Download
memory/2548-2-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2548-3-0x0000000000310000-0x0000000000328000-memory.dmp

Filesize
96KB

Download
memory/2548-4-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-5-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2548-6-0x0000000000200000-0x000000000020A000-memory.dmp

Filesize
40KB

Download
memory/2548-7-0x0000000004C90000-0x0000000004CF0000-memory.dmp

Filesize
384KB

Download
memory/2548-0-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-27-0x000000006EC50000-0x000000006F1FB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-28-0x000000006EC50000-0x000000006F1FB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-33-0x000000006EC50000-0x000000006F1FB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-31-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/2712-30-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/3008-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-25-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-29-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3008-32-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download
memory/3008-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3008-34-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-35-0x0000000000380000-0x00000000003C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads