snakekeylogger | 65fb603f3c14fec0e614514bae2316a4fb76052d64a4bf789946cfc04d0a7a93

General

Target

e1cd5964eb8a81b814e11f949211ec3d.exe
Size

821KB
MD5

e1cd5964eb8a81b814e11f949211ec3d
SHA1

e1d0b8c6be5bebe4373658098a765458913b04b5
SHA256

65fb603f3c14fec0e614514bae2316a4fb76052d64a4bf789946cfc04d0a7a93
SHA512

15b8745496b4f37510d3690e7951635279cf1dba254975774b9f00578c916ecbf4a3bd91be19654837ed50689a9b6789eb08e7e4ed2d7e59291b35df89ec782a
SSDEEP

12288:0QDc9F3nC0Py3gAhD+ESeG1mh9r0lm6yKw4Z6sDjZ0vc/OCGnvvTG0RPVbQV8T92:0PJVmhV0I6yq6ajZ0v2+RQg9shtbcZ

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Chukwudim28@
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4516-17-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e1cd5964eb8a81b814e11f949211ec3d.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	e1cd5964eb8a81b814e11f949211ec3d.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

65 freegeoip.app
66 freegeoip.app
63 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

e1cd5964eb8a81b814e11f949211ec3d.exe

description pid process target process

PID 4340 set thread context of 4516 4340 e1cd5964eb8a81b814e11f949211ec3d.exe e1cd5964eb8a81b814e11f949211ec3d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3588 4516 WerFault.exe e1cd5964eb8a81b814e11f949211ec3d.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1120 schtasks.exe

flow	ioc
65	freegeoip.app
66	freegeoip.app
63	checkip.dyndns.org

description	pid	process	target process
PID 4340 set thread context of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe

pid	pid_target	process	target process
3588	4516	WerFault.exe	e1cd5964eb8a81b814e11f949211ec3d.exe

pid	process
1120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e1cd5964eb8a81b814e11f949211ec3d.exee1cd5964eb8a81b814e11f949211ec3d.exe

pid	process
4340	e1cd5964eb8a81b814e11f949211ec3d.exe
4340	e1cd5964eb8a81b814e11f949211ec3d.exe
4340	e1cd5964eb8a81b814e11f949211ec3d.exe
4340	e1cd5964eb8a81b814e11f949211ec3d.exe
4516	e1cd5964eb8a81b814e11f949211ec3d.exe
4516	e1cd5964eb8a81b814e11f949211ec3d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e1cd5964eb8a81b814e11f949211ec3d.exee1cd5964eb8a81b814e11f949211ec3d.exe

description pid process

Token: SeDebugPrivilege 4340 e1cd5964eb8a81b814e11f949211ec3d.exe
Token: SeDebugPrivilege 4516 e1cd5964eb8a81b814e11f949211ec3d.exe

description	pid	process
Token: SeDebugPrivilege	4340	e1cd5964eb8a81b814e11f949211ec3d.exe
Token: SeDebugPrivilege	4516	e1cd5964eb8a81b814e11f949211ec3d.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

e1cd5964eb8a81b814e11f949211ec3d.exe

description	pid	process	target process
PID 4340 wrote to memory of 1120	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	schtasks.exe
PID 4340 wrote to memory of 1120	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	schtasks.exe
PID 4340 wrote to memory of 1120	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	schtasks.exe
PID 4340 wrote to memory of 3640	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 3640	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 3640	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe
PID 4340 wrote to memory of 4516	4340	e1cd5964eb8a81b814e11f949211ec3d.exe	e1cd5964eb8a81b814e11f949211ec3d.exe

C:\Users\Admin\AppData\Local\Temp\e1cd5964eb8a81b814e11f949211ec3d.exe
"C:\Users\Admin\AppData\Local\Temp\e1cd5964eb8a81b814e11f949211ec3d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CKQbPIcN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp"
2⤵
- Creates scheduled task(s)
PID:1120

C:\Users\Admin\AppData\Local\Temp\e1cd5964eb8a81b814e11f949211ec3d.exe
"C:\Users\Admin\AppData\Local\Temp\e1cd5964eb8a81b814e11f949211ec3d.exe"
2⤵
PID:3640

C:\Users\Admin\AppData\Local\Temp\e1cd5964eb8a81b814e11f949211ec3d.exe
"C:\Users\Admin\AppData\Local\Temp\e1cd5964eb8a81b814e11f949211ec3d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1788
3⤵
- Program crash
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4516 -ip 4516
1⤵
PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e1cd5964eb8a81b814e11f949211ec3d.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp
Filesize
1KB

MD5
4e847dfe0445b55955d8953526fb9956

SHA1
69cc1cc12273a9703bbeea20c922387fec43bf67

SHA256
b4f7959204f7d6c9eebf270b60b483b0a293d3a8dccc918731b4a9c4b4963d4e

SHA512
b3a7208de05da3275b19036edea298f4a532717ceb60d620c4b37fd841345e54cc31bfb87cfa1741974ea9e005474d21e8a129cff0b721fc8f05e21e5d1a2898

Download Submit
memory/4340-4-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/4340-11-0x0000000008880000-0x00000000088B8000-memory.dmp

Filesize
224KB

Download
memory/4340-1-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4340-5-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/4340-6-0x00000000056B0000-0x000000000574C000-memory.dmp

Filesize
624KB

Download
memory/4340-7-0x00000000054B0000-0x00000000054C8000-memory.dmp

Filesize
96KB

Download
memory/4340-8-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4340-9-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/4340-10-0x00000000062E0000-0x0000000006380000-memory.dmp

Filesize
640KB

Download
memory/4340-3-0x0000000005310000-0x00000000053A2000-memory.dmp

Filesize
584KB

Download
memory/4340-2-0x00000000057E0000-0x0000000005D84000-memory.dmp

Filesize
5.6MB

Download
memory/4340-20-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4340-0-0x0000000000810000-0x00000000008E4000-memory.dmp

Filesize
848KB

Download
memory/4516-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4516-21-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download
memory/4516-22-0x00000000052E0000-0x00000000052F0000-memory.dmp

Filesize
64KB

Download
memory/4516-23-0x0000000074930000-0x00000000750E0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads