snakekeylogger | 3f1bf2c3a2ce3446b2cc1a91c69b4bcdcdb97340965b26dd5a8b59819f91def9

General

Target

SWIFT MESAJI.exe
Size

718KB
MD5

b77072d6441ab7e6b291e04060ac8f2c
SHA1

c55d28766fe51465285dad55b6379949ba6e37e2
SHA256

3f1bf2c3a2ce3446b2cc1a91c69b4bcdcdb97340965b26dd5a8b59819f91def9
SHA512

59ce747954216eafa328457163a7afa052a920b9a148ff254f6cccd83a810bf0c27ec735060573f4920098b035633b7da11630e9fc6ed87510cc4505b1f588c9
SSDEEP

12288:/ti1KYlszhDKpeWRAX5WvLHuiQTLpWTZSgmcEKbigohGg1Zf8eQGI195d7BR6wTg:/MyDKpeWRAXEJQTckV0+gQf8JGYfpBhC

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.belt-tech.com.my
Port:
587
Username:
[email protected]
Password:
Beltechpg@1234
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2460-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2460-24-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2460-27-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2460-29-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2460-31-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT MESAJI.exe

description pid process target process

PID 1704 set thread context of 2460 1704 SWIFT MESAJI.exe SWIFT MESAJI.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2368 2460 WerFault.exe SWIFT MESAJI.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2588 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

SWIFT MESAJI.exeSWIFT MESAJI.exepowershell.exepowershell.exe

pid process

1704 SWIFT MESAJI.exe
1704 SWIFT MESAJI.exe
1704 SWIFT MESAJI.exe
1704 SWIFT MESAJI.exe
2460 SWIFT MESAJI.exe
2660 powershell.exe
3060 powershell.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 1704 set thread context of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe

pid	pid_target	process	target process
2368	2460	WerFault.exe	SWIFT MESAJI.exe

pid	process
2588	schtasks.exe

pid	process
1704	SWIFT MESAJI.exe
1704	SWIFT MESAJI.exe
1704	SWIFT MESAJI.exe
1704	SWIFT MESAJI.exe
2460	SWIFT MESAJI.exe
2660	powershell.exe
3060	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SWIFT MESAJI.exeSWIFT MESAJI.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1704	SWIFT MESAJI.exe
Token: SeDebugPrivilege	2460	SWIFT MESAJI.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

SWIFT MESAJI.exeSWIFT MESAJI.exe

description	pid	process	target process
PID 1704 wrote to memory of 3060	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 3060	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 3060	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 3060	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 2660	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 2660	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 2660	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 2660	1704	SWIFT MESAJI.exe	powershell.exe
PID 1704 wrote to memory of 2588	1704	SWIFT MESAJI.exe	schtasks.exe
PID 1704 wrote to memory of 2588	1704	SWIFT MESAJI.exe	schtasks.exe
PID 1704 wrote to memory of 2588	1704	SWIFT MESAJI.exe	schtasks.exe
PID 1704 wrote to memory of 2588	1704	SWIFT MESAJI.exe	schtasks.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 1704 wrote to memory of 2460	1704	SWIFT MESAJI.exe	SWIFT MESAJI.exe
PID 2460 wrote to memory of 2368	2460	SWIFT MESAJI.exe	WerFault.exe
PID 2460 wrote to memory of 2368	2460	SWIFT MESAJI.exe	WerFault.exe
PID 2460 wrote to memory of 2368	2460	SWIFT MESAJI.exe	WerFault.exe
PID 2460 wrote to memory of 2368	2460	SWIFT MESAJI.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT MESAJI.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT MESAJI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SWIFT MESAJI.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OXizYWLoEaCDIE.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OXizYWLoEaCDIE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB0E.tmp"
2⤵
- Creates scheduled task(s)
PID:2588

C:\Users\Admin\AppData\Local\Temp\SWIFT MESAJI.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT MESAJI.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 1076
3⤵
- Program crash
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAB0E.tmp

Filesize
1KB

MD5
65a42a51c103bfb53eff51882315da75

SHA1
83b9388b1614c363231afe180c23c5c425a6cd25

SHA256
5e2223ace504f0f7bbadf5eb3ea90bf3374f8165ffe3d5e819e332efb1270011

SHA512
892911e8fad49f4109e04bf53eb58aa8e520de3e77871300e058c8b196bc50492e3efd0b6e15cbf819ce61d0204291908f34e27a0d35cd38d7784c3548651c94

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\29NT20RGU5HJ6K586JZ1.temp

Filesize
7KB

MD5
313d359d6b2ac162640428067c2bb39a

SHA1
d4a609f93b4a3da550a78b614614fe644fb26a27

SHA256
de26b0e48eff5a2a43eaf4ed3f33405094d613a791cc260a17cb901da969d4c0

SHA512
17ced316acb3677bec377057c656f384dbc0e2a85403b1eed2b32f50ee71eff68b7d7984e666a61162b1b8e6a46247df266d145b6714c04dc377582fb4437fa2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
313d359d6b2ac162640428067c2bb39a

SHA1
d4a609f93b4a3da550a78b614614fe644fb26a27

SHA256
de26b0e48eff5a2a43eaf4ed3f33405094d613a791cc260a17cb901da969d4c0

SHA512
17ced316acb3677bec377057c656f384dbc0e2a85403b1eed2b32f50ee71eff68b7d7984e666a61162b1b8e6a46247df266d145b6714c04dc377582fb4437fa2

Download Submit
memory/1704-3-0x0000000004130000-0x000000000414A000-memory.dmp

Filesize
104KB

Download
memory/1704-4-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/1704-5-0x0000000003FB0000-0x0000000003FBA000-memory.dmp

Filesize
40KB

Download
memory/1704-6-0x0000000005A30000-0x0000000005A90000-memory.dmp

Filesize
384KB

Download
memory/1704-7-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-0-0x0000000000060000-0x000000000011A000-memory.dmp

Filesize
744KB

Download
memory/1704-2-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/1704-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-32-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/1704-22-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2460-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2460-39-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-27-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-29-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-31-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-44-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2460-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2460-43-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2660-34-0x000000006EEA0000-0x000000006F44B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-38-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/2660-40-0x000000006EEA0000-0x000000006F44B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-42-0x000000006EEA0000-0x000000006F44B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-37-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/3060-36-0x000000006EEA0000-0x000000006F44B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-41-0x000000006EEA0000-0x000000006F44B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-35-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/3060-33-0x000000006EEA0000-0x000000006F44B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads