snakekeylogger | 657ab2e0b548b6d45d54b284682a382e33a1ae822194b1d6e17c47ae5e0a115c

General

Target

896f1eaa7dc457642682f569e4ffbc21.exe
Size

799KB
MD5

896f1eaa7dc457642682f569e4ffbc21
SHA1

1d65bfd8b10dcdfe5cccfd9a654556a78d4d6c76
SHA256

657ab2e0b548b6d45d54b284682a382e33a1ae822194b1d6e17c47ae5e0a115c
SHA512

585bf0eddab8a9cc2b86527f584d40f3251535ab90ff5e3c388b6c3c1a371fa76aaf3614b3d0a2770f6a0bbf684c76aab3eea49fc4b7fd4bf1652c197a74c39c
SSDEEP

6144:wTVjYQSQ2GhNq2GhNLe4BoFPi84iYuoyOYuWiiv12KsoLAWFrtTTDdCNYXKyxkcx:wNt2iNq2iNNixAyv1TsJWHTTxmG9x

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.codiis.com
Port:
587
Username:
[email protected]
Password:
AAaa2@@4
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3820-17-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

896f1eaa7dc457642682f569e4ffbc21.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	896f1eaa7dc457642682f569e4ffbc21.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 freegeoip.app
46 freegeoip.app
43 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

896f1eaa7dc457642682f569e4ffbc21.exe

description pid process target process

PID 1116 set thread context of 3820 1116 896f1eaa7dc457642682f569e4ffbc21.exe 896f1eaa7dc457642682f569e4ffbc21.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2204 3820 WerFault.exe 896f1eaa7dc457642682f569e4ffbc21.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2860 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

896f1eaa7dc457642682f569e4ffbc21.exe

pid process

3820 896f1eaa7dc457642682f569e4ffbc21.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

896f1eaa7dc457642682f569e4ffbc21.exe

description pid process

Token: SeDebugPrivilege 3820 896f1eaa7dc457642682f569e4ffbc21.exe

flow	ioc
45	freegeoip.app
46	freegeoip.app
43	checkip.dyndns.org

description	pid	process	target process
PID 1116 set thread context of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe

pid	pid_target	process	target process
2204	3820	WerFault.exe	896f1eaa7dc457642682f569e4ffbc21.exe

pid	process
2860	schtasks.exe

pid	process
3820	896f1eaa7dc457642682f569e4ffbc21.exe

description	pid	process
Token: SeDebugPrivilege	3820	896f1eaa7dc457642682f569e4ffbc21.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

896f1eaa7dc457642682f569e4ffbc21.exe

description	pid	process	target process
PID 1116 wrote to memory of 2860	1116	896f1eaa7dc457642682f569e4ffbc21.exe	schtasks.exe
PID 1116 wrote to memory of 2860	1116	896f1eaa7dc457642682f569e4ffbc21.exe	schtasks.exe
PID 1116 wrote to memory of 2860	1116	896f1eaa7dc457642682f569e4ffbc21.exe	schtasks.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe
PID 1116 wrote to memory of 3820	1116	896f1eaa7dc457642682f569e4ffbc21.exe	896f1eaa7dc457642682f569e4ffbc21.exe

C:\Users\Admin\AppData\Local\Temp\896f1eaa7dc457642682f569e4ffbc21.exe
"C:\Users\Admin\AppData\Local\Temp\896f1eaa7dc457642682f569e4ffbc21.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UmjwcGPH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF378.tmp"
2⤵
- Creates scheduled task(s)
PID:2860

C:\Users\Admin\AppData\Local\Temp\896f1eaa7dc457642682f569e4ffbc21.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 1816
3⤵
- Program crash
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3820 -ip 3820
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\896f1eaa7dc457642682f569e4ffbc21.exe.log

Filesize
1KB

MD5
bb3d30439ec1e6435c3eac4df8c1d2e3

SHA1
c901d5946e53ae0a9e2417c8dfaf5786a0037422

SHA256
182adf89e57f80a92db9a5e13105cd59544f37855ca35f98116a0182ddd3b2e6

SHA512
d3547aadf665ce2552b3dfa350b80a5e813aa346870fb2b05a3b998096eebf563143bffe964e0f7243761b79420d1adf02f735779902901d1a41a1f35c557572

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF378.tmp

Filesize
1KB

MD5
28085c2395756276bab8564e37ee8567

SHA1
07588bcfdb95197c76cf9ef4e417a1fbc910d192

SHA256
71e18db4d1f85164a90fb027204b20a8267e3a6f33218f97a8fafd96d1c17e50

SHA512
652c832bc40cc97943ca90da97b138c2a47d10121ee51db47548ccd81aa990b7411d36b70ecc5def10408d62a0b0e78ff1c55f0e156eed92d1dbb11d1b80bf86

Download Submit
memory/1116-10-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/1116-11-0x0000000005D70000-0x0000000005D80000-memory.dmp

Filesize
64KB

Download
memory/1116-4-0x0000000005B40000-0x0000000005BD2000-memory.dmp

Filesize
584KB

Download
memory/1116-5-0x0000000005D70000-0x0000000005D80000-memory.dmp

Filesize
64KB

Download
memory/1116-6-0x0000000005AF0000-0x0000000005AFA000-memory.dmp

Filesize
40KB

Download
memory/1116-7-0x0000000005D80000-0x0000000005DD6000-memory.dmp

Filesize
344KB

Download
memory/1116-8-0x0000000006600000-0x0000000006954000-memory.dmp

Filesize
3.3MB

Download
memory/1116-9-0x00000000032C0000-0x00000000032D4000-memory.dmp

Filesize
80KB

Download
memory/1116-0-0x0000000000F90000-0x000000000105E000-memory.dmp

Filesize
824KB

Download
memory/1116-3-0x0000000006050000-0x00000000065F4000-memory.dmp

Filesize
5.6MB

Download
memory/1116-12-0x0000000009020000-0x0000000009090000-memory.dmp

Filesize
448KB

Download
memory/1116-13-0x0000000009090000-0x00000000090B4000-memory.dmp

Filesize
144KB

Download
memory/1116-2-0x00000000059D0000-0x0000000005A6C000-memory.dmp

Filesize
624KB

Download
memory/1116-21-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/1116-1-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/3820-20-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/3820-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3820-22-0x00000000051D0000-0x00000000051E0000-memory.dmp

Filesize
64KB

Download
memory/3820-23-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads