snakekeylogger | 1d7069432d20883d8bf613e91d3a78de608bb7e7fa2b6daf1252e5da9a717ba2

General

Target

ekstre.exe
Size

628KB
MD5

7eec1e611d996a5f2792c9778da882bc
SHA1

90b7ad77edd7e61499d8e0160490bce4c9366934
SHA256

1d7069432d20883d8bf613e91d3a78de608bb7e7fa2b6daf1252e5da9a717ba2
SHA512

3bcb54831392b6b6c0c976f4c9940590e0095d14859d02a639a0908ef131039d323f5601a142196c47e6d43f473f3fd8999b47c79f247380660e1eb413b91bea
SSDEEP

12288:QWOTNXc3hEunBAFnSuBVZ60SwMPAF98gb8X+SHucpVHGH:332uBqSu9FHMPAF76+SLVHG

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.alupanorama.com.my
Port:
587
Username:
[email protected]
Password:
t9&KsFB5dPgV
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2516-24-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2516-26-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2516-30-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2516-32-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2516-35-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ekstre.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ekstre.exe
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ekstre.exe
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ekstre.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

ekstre.exe

description pid process target process

PID 1788 set thread context of 2516 1788 ekstre.exe ekstre.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2076 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

ekstre.exeekstre.exepowershell.exepowershell.exe

pid process

1788 ekstre.exe
1788 ekstre.exe
1788 ekstre.exe
1788 ekstre.exe
2516 ekstre.exe
2748 powershell.exe
2712 powershell.exe
2516 ekstre.exe

flow	ioc
2	checkip.dyndns.org

description	pid	process	target process
PID 1788 set thread context of 2516	1788	ekstre.exe	ekstre.exe

pid	process
2076	schtasks.exe

pid	process
1788	ekstre.exe
1788	ekstre.exe
1788	ekstre.exe
1788	ekstre.exe
2516	ekstre.exe
2748	powershell.exe
2712	powershell.exe
2516	ekstre.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

ekstre.exeekstre.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1788	ekstre.exe
Token: SeDebugPrivilege	2516	ekstre.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

ekstre.exe

description	pid	process	target process
PID 1788 wrote to memory of 2712	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2712	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2748	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2748	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2748	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2748	1788	ekstre.exe	powershell.exe
PID 1788 wrote to memory of 2076	1788	ekstre.exe	schtasks.exe
PID 1788 wrote to memory of 2076	1788	ekstre.exe	schtasks.exe
PID 1788 wrote to memory of 2076	1788	ekstre.exe	schtasks.exe
PID 1788 wrote to memory of 2076	1788	ekstre.exe	schtasks.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe
PID 1788 wrote to memory of 2516	1788	ekstre.exe	ekstre.exe

outlook_office_path 1 IoCs

Processes:

ekstre.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ekstre.exe

outlook_win_path 1 IoCs

Processes:

ekstre.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ekstre.exe

C:\Users\Admin\AppData\Local\Temp\ekstre.exe
"C:\Users\Admin\AppData\Local\Temp\ekstre.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ekstre.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PjzCeIhiuryZzE.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PjzCeIhiuryZzE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF289.tmp"
2⤵
- Creates scheduled task(s)
PID:2076

C:\Users\Admin\AppData\Local\Temp\ekstre.exe
"C:\Users\Admin\AppData\Local\Temp\ekstre.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF289.tmp

Filesize
1KB

MD5
65826f5710d0ac055d1733953c71278b

SHA1
2a5784dd8e447569438a1a00d89b6dedb898d91c

SHA256
c85305155a502b696fd8f54a25e5382baebd2859372760776bf63bdcad532649

SHA512
68dd952524a6ad5286194959af1d47343f7ec5c99c9b9ff9a9ab5c4f06ea456452aa584a13f6ebaa3439e7d6fd3520e36c778c18b16ccd29d5d15e06071bb69c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KCUZRG73LGVL1YAKGDTP.temp

Filesize
7KB

MD5
7e86e9945cb35d8cca7724511357e500

SHA1
0acbeb39ee64a76e3f85099a8cf86ab4ec53081a

SHA256
54a78bc512744dc43260132f22b6b61dfe5c4f32a318e954f7d8250073d373f8

SHA512
3c9273e47c2e8947a4956ca4cb0fcad6da128273ae9555a29e40bddf4a5d225de76247dec347b1776545002c03eec2cf406d6d48fdc2ee7dc03b2b2cff43d5d8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
7e86e9945cb35d8cca7724511357e500

SHA1
0acbeb39ee64a76e3f85099a8cf86ab4ec53081a

SHA256
54a78bc512744dc43260132f22b6b61dfe5c4f32a318e954f7d8250073d373f8

SHA512
3c9273e47c2e8947a4956ca4cb0fcad6da128273ae9555a29e40bddf4a5d225de76247dec347b1776545002c03eec2cf406d6d48fdc2ee7dc03b2b2cff43d5d8

Download Submit
memory/1788-0-0x0000000000860000-0x0000000000902000-memory.dmp

Filesize
648KB

Download
memory/1788-1-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-2-0x0000000004200000-0x0000000004240000-memory.dmp

Filesize
256KB

Download
memory/1788-3-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/1788-4-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1788-5-0x0000000005070000-0x00000000050D0000-memory.dmp

Filesize
384KB

Download
memory/1788-6-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-34-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-21-0x0000000004200000-0x0000000004240000-memory.dmp

Filesize
256KB

Download
memory/2516-30-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-26-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2516-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-32-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-35-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2516-48-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2516-47-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-41-0x0000000074EA0000-0x000000007558E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-39-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Filesize
5.7MB

Download
memory/2712-40-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/2712-38-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/2712-44-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/2712-46-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Filesize
5.7MB

Download
memory/2712-36-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-42-0x0000000002520000-0x0000000002560000-memory.dmp

Filesize
256KB

Download
memory/2748-43-0x0000000002520000-0x0000000002560000-memory.dmp

Filesize
256KB

Download
memory/2748-45-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Filesize
5.7MB

Download
memory/2748-37-0x000000006E9D0000-0x000000006EF7B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads