snakekeylogger | 02cb785366112aa7f83df7363d3fcf17fe704f1a4938821cd1ea3fa9fce8a701

General

Target

e07f355829788140870b101e94625d62.exe
Size

625KB
MD5

e07f355829788140870b101e94625d62
SHA1

9e22399bbe6232f63d59430ba9c5214b30a1a83f
SHA256

02cb785366112aa7f83df7363d3fcf17fe704f1a4938821cd1ea3fa9fce8a701
SHA512

4ee66ac7900c5d6fa4ca3a7d786c05ad8a0b35e1fd9fc622c9fdc059b27371b1f3321b17497d582ea199f47c94749a96d8a21b7398e94fa7d3dfec78dd2a47ee
SSDEEP

12288:fean0/aOXQ1+PPp8Nyn54A6MP09T9pDEOnbJvubEt5nm1:feN/aBCp/d89T8Gb1y+g

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
jBgPrcvY6
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3824-17-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e07f355829788140870b101e94625d62.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	e07f355829788140870b101e94625d62.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

57 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

e07f355829788140870b101e94625d62.exe

description pid process target process

PID 1956 set thread context of 3824 1956 e07f355829788140870b101e94625d62.exe e07f355829788140870b101e94625d62.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2352 3824 WerFault.exe e07f355829788140870b101e94625d62.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4564 schtasks.exe

flow	ioc
57	checkip.dyndns.org

description	pid	process	target process
PID 1956 set thread context of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe

pid	pid_target	process	target process
2352	3824	WerFault.exe	e07f355829788140870b101e94625d62.exe

pid	process
4564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e07f355829788140870b101e94625d62.exee07f355829788140870b101e94625d62.exe

pid	process
1956	e07f355829788140870b101e94625d62.exe
1956	e07f355829788140870b101e94625d62.exe
3824	e07f355829788140870b101e94625d62.exe
3824	e07f355829788140870b101e94625d62.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e07f355829788140870b101e94625d62.exee07f355829788140870b101e94625d62.exe

description pid process

Token: SeDebugPrivilege 1956 e07f355829788140870b101e94625d62.exe
Token: SeDebugPrivilege 3824 e07f355829788140870b101e94625d62.exe

description	pid	process
Token: SeDebugPrivilege	1956	e07f355829788140870b101e94625d62.exe
Token: SeDebugPrivilege	3824	e07f355829788140870b101e94625d62.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

e07f355829788140870b101e94625d62.exe

description	pid	process	target process
PID 1956 wrote to memory of 4564	1956	e07f355829788140870b101e94625d62.exe	schtasks.exe
PID 1956 wrote to memory of 4564	1956	e07f355829788140870b101e94625d62.exe	schtasks.exe
PID 1956 wrote to memory of 4564	1956	e07f355829788140870b101e94625d62.exe	schtasks.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe
PID 1956 wrote to memory of 3824	1956	e07f355829788140870b101e94625d62.exe	e07f355829788140870b101e94625d62.exe

C:\Users\Admin\AppData\Local\Temp\e07f355829788140870b101e94625d62.exe
"C:\Users\Admin\AppData\Local\Temp\e07f355829788140870b101e94625d62.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ayHCSxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp849C.tmp"
2⤵
- Creates scheduled task(s)
PID:4564

C:\Users\Admin\AppData\Local\Temp\e07f355829788140870b101e94625d62.exe
"C:\Users\Admin\AppData\Local\Temp\e07f355829788140870b101e94625d62.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 1500
3⤵
- Program crash
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3824 -ip 3824
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e07f355829788140870b101e94625d62.exe.log
Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp849C.tmp
Filesize
1KB

MD5
acc48b75e931734bdd439a07f8c35654

SHA1
e951b93da52afce4c9d4dd086f543920a90a1b82

SHA256
9f8a3cd2f4a2d139b9d948dc2a4303ebd7f275f8f54b819275f16187cfcb7f7d

SHA512
e90c939099e2ce0620f0dfdf48dcde6fb21bc91346edac6ec88360521287d8b2829e53e3348d8aebeed4e2ad65fa2b167055c96163b15ff599f71d433229b406

Download Submit
memory/1956-4-0x0000000005460000-0x00000000054FC000-memory.dmp

Filesize
624KB

Download
memory/1956-11-0x00000000092E0000-0x0000000009306000-memory.dmp

Filesize
152KB

Download
memory/1956-0-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/1956-5-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/1956-6-0x0000000005380000-0x000000000538A000-memory.dmp

Filesize
40KB

Download
memory/1956-7-0x0000000006B10000-0x0000000006B22000-memory.dmp

Filesize
72KB

Download
memory/1956-8-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/1956-9-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/1956-10-0x0000000006BB0000-0x0000000006C42000-memory.dmp

Filesize
584KB

Download
memory/1956-3-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/1956-2-0x00000000058D0000-0x0000000005E74000-memory.dmp

Filesize
5.6MB

Download
memory/1956-21-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/1956-1-0x00000000008E0000-0x0000000000982000-memory.dmp

Filesize
648KB

Download
memory/3824-20-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/3824-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3824-22-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/3824-23-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads