snakekeylogger | 99863c2b4f9560c1dfd5430f9862d225b28b84a3a8caa58d5013d2a6514ec2b0

General

Target

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
Size

44KB
MD5

41bce404371579a1e6db304042d2e72e
SHA1

55378787edb8d473893099cc206fd5554213caa9
SHA256

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56
SHA512

66e5e32da35d76208dac11bbfa8a232ab1d77f1d08ad377bbe04a33de395ff82248a82dc8f51df9d029ad461ebdb23300d0b549f2bf6149c1ff0b64cfb99af9c
SSDEEP

768:DbynQEfPx5vJYrEXURJ5fTpSgKS08c9YDveruxPhreB3SUFjIHEIx:3ix7cEWZpSgKnUDGA6BZFmfx

Score

10^/10

snakekeylogger collection keylogger persistence stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6350529534:AAEbFW9VBWTKQfN1Y3K_5RJARCtOn1UqK8o/sendMessage?chat_id=1467583453

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2784-11-0x0000000140000000-0x0000000140022000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
Key opened	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
Key opened	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zinveune = "C:\\Users\\Admin\\AppData\\Roaming\\Zinveune.exe"	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

66 checkip.dyndns.org

flow	ioc
66	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	pid	process	target process
PID 1696 set thread context of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

pid	process
2784	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
2784	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exeebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	pid	process
Token: SeDebugPrivilege	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
Token: SeDebugPrivilege	2784	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	pid	process	target process
PID 1696 wrote to memory of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
PID 1696 wrote to memory of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
PID 1696 wrote to memory of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
PID 1696 wrote to memory of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
PID 1696 wrote to memory of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
PID 1696 wrote to memory of 2784	1696	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

outlook_office_path 1 IoCs

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

outlook_win_path 1 IoCs

Processes:

ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe

C:\Users\Admin\AppData\Local\Temp\ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
"C:\Users\Admin\AppData\Local\Temp\ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
C:\Users\Admin\AppData\Local\Temp\ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ebb6fad910c99d151b30733b624e8f7e555eb7de7caaa66d65b9e7114c433f56.exe.log

Filesize
1KB

MD5
8094b248fe3231e48995c2be32aeb08c

SHA1
2fe06e000ebec919bf982d033c5d1219c1f916b6

SHA256
136c30d964f4abbb5279bdc86d0e00578333782f15f05f0d2d050730dcb7a9bc

SHA512
bf27a3822008796370e2c506c910a40992b9240606ea1bc19f683b2fee86b81897660ac0cf8e746ca093dae9e408949e2e9002ded75678a69f020d3b0452801f

Download Submit
memory/1696-4-0x00007FFA87500000-0x00007FFA87FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1696-7-0x0000026A1E010000-0x0000026A1E048000-memory.dmp

Filesize
224KB

Download
memory/1696-3-0x0000026A03DE0000-0x0000026A03DE6000-memory.dmp

Filesize
24KB

Download
memory/1696-0-0x0000026A03A20000-0x0000026A03A2E000-memory.dmp

Filesize
56KB

Download
memory/1696-9-0x0000026A1EBE0000-0x0000026A1EC2C000-memory.dmp

Filesize
304KB

Download
memory/1696-6-0x0000026A05780000-0x0000026A057D0000-memory.dmp

Filesize
320KB

Download
memory/1696-2-0x0000026A1E060000-0x0000026A1E070000-memory.dmp

Filesize
64KB

Download
memory/1696-8-0x0000026A1EBA0000-0x0000026A1EBD6000-memory.dmp

Filesize
216KB

Download
memory/1696-5-0x0000026A1E060000-0x0000026A1E070000-memory.dmp

Filesize
64KB

Download
memory/1696-15-0x00007FFA87500000-0x00007FFA87FC1000-memory.dmp

Filesize
10.8MB

Download
memory/1696-1-0x00007FFA87500000-0x00007FFA87FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2784-12-0x00007FFA87500000-0x00007FFA87FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2784-11-0x0000000140000000-0x0000000140022000-memory.dmp

Filesize
136KB

Download
memory/2784-16-0x00007FFA87500000-0x00007FFA87FC1000-memory.dmp

Filesize
10.8MB

Download
memory/2784-17-0x0000025B3B2E0000-0x0000025B3B2F0000-memory.dmp

Filesize
64KB

Download
memory/2784-18-0x0000025B3B2E0000-0x0000025B3B2F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads