snakekeylogger | 13d3f276a58ec7259ce36fc73497417dc35deae08c16eee00b642d0d59b11593

General

Target

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
Size

679KB
MD5

04cb26da2d9222bf9204ad1f2307310c
SHA1

e80af5a2284c9cc5ec51315b8b95a5aecf62b449
SHA256

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a
SHA512

528c78b8e02ecf36c85c4d0c023d57302efa6206d7e5caefb60c764fe648984faaaa434906e9014b54b5fa5a28169a8b6fc0da4a11c7e1529086017f6965b8e6
SSDEEP

12288:Kj40L5klf7Lr0QnQ3Ei9PyMHpEIKUFO2xgOZK7YDeCNAmC:KTLKjLr0QnQ1MoECksCCNAmC

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6076917727:AAGbsf1c44EC0CR26JUQPsvvVqX6Ki5kb9k/sendMessage?chat_id=6282564049

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2624-19-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2624-21-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2624-25-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2624-27-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2624-29-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2624-32-0x0000000000D10000-0x0000000000D50000-memory.dmp	family_snakekeylogger

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
Key opened	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
Key opened	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

description	pid	process	target process
PID 2424 set thread context of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

788 2624 WerFault.exe bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2648 schtasks.exe

pid	pid_target	process	target process
788	2624	WerFault.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

pid	process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exebce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exepowershell.exe

pid	process
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
2296	powershell.exe
2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exebce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
Token: SeDebugPrivilege	2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
Token: SeDebugPrivilege	2296	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exebce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

description	pid	process	target process
PID 2424 wrote to memory of 2296	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	powershell.exe
PID 2424 wrote to memory of 2296	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	powershell.exe
PID 2424 wrote to memory of 2296	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	powershell.exe
PID 2424 wrote to memory of 2296	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	powershell.exe
PID 2424 wrote to memory of 2648	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	schtasks.exe
PID 2424 wrote to memory of 2648	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	schtasks.exe
PID 2424 wrote to memory of 2648	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	schtasks.exe
PID 2424 wrote to memory of 2648	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	schtasks.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2424 wrote to memory of 2624	2424	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
PID 2624 wrote to memory of 788	2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	WerFault.exe
PID 2624 wrote to memory of 788	2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	WerFault.exe
PID 2624 wrote to memory of 788	2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	WerFault.exe
PID 2624 wrote to memory of 788	2624	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

outlook_win_path 1 IoCs

Processes:

bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe

C:\Users\Admin\AppData\Local\Temp\bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
"C:\Users\Admin\AppData\Local\Temp\bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TiEZzc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TiEZzc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2FF.tmp"
2⤵
- Creates scheduled task(s)
PID:2648

C:\Users\Admin\AppData\Local\Temp\bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe
"C:\Users\Admin\AppData\Local\Temp\bce910742ec10a1cdffe6c194b65c2a66980dff76b5fdc56c46a6d9a9f41d48a.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 1096
3⤵
- Program crash
PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE2FF.tmp

Filesize
1KB

MD5
68a737540a302f62062873375472c72f

SHA1
59b2175a268451686e07887580d709aa802392ff

SHA256
27c26c0c80f96398ae481a01523b8acc11fb67ab0f173dcc2772923504c20d72

SHA512
088c1b886aef3bab71774769520857059d4234c795a2d0a854f81b64ab9905eb2a0553ac8bea83394d4b6a56ef4487fbc55d858b634334544cbd804e21777a5c

Download Submit
memory/2296-33-0x000000006E510000-0x000000006EABB000-memory.dmp

Filesize
5.7MB

Download
memory/2296-34-0x000000006E510000-0x000000006EABB000-memory.dmp

Filesize
5.7MB

Download
memory/2296-35-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/2296-36-0x000000006E510000-0x000000006EABB000-memory.dmp

Filesize
5.7MB

Download
memory/2424-3-0x00000000003B0000-0x00000000003BC000-memory.dmp

Filesize
48KB

Download
memory/2424-6-0x0000000000390000-0x000000000039C000-memory.dmp

Filesize
48KB

Download
memory/2424-7-0x0000000000F30000-0x0000000000F90000-memory.dmp

Filesize
384KB

Download
memory/2424-5-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/2424-4-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-30-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-2-0x0000000005020000-0x0000000005060000-memory.dmp

Filesize
256KB

Download
memory/2424-0-0x00000000011D0000-0x0000000001280000-memory.dmp

Filesize
704KB

Download
memory/2424-1-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2624-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-27-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-29-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-25-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-31-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2624-32-0x0000000000D10000-0x0000000000D50000-memory.dmp

Filesize
256KB

Download
memory/2624-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2624-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2624-37-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2624-38-0x0000000000D10000-0x0000000000D50000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads