snakekeylogger | fed609268e1fbbc621e084ce4676924dc13ee5055eb5383e8b57adae9a11631c

General

Target

FATEYU07655700000.exe
Size

1.1MB
MD5

08e5e7017a40d8322c02f2d3b993624d
SHA1

e359655b63f24de274aef8932c096f2e0e1baa1d
SHA256

fed609268e1fbbc621e084ce4676924dc13ee5055eb5383e8b57adae9a11631c
SHA512

9d49ea2f6c71cc845bcd06d601c400f91e67fc56c262b9d20afa74fd400b83e3da5e7111ead5a52b85f21d13b7fe8c9e10e72bd25c17e8c5058527bc8374d646
SSDEEP

24576:HAHnh+eWsN3skA4RV1Hom2KXMmHarir1LuvCCcOSYCvsd5:6h+ZkldoPK8YariPCccCe

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://scratchdreams.tk

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 33 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3036-33-0x0000000002FD0000-0x000000000300A000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-37-0x0000000005680000-0x00000000056B8000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-38-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-39-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-41-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-43-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-45-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-47-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-49-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-51-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-53-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-55-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-57-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-59-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-61-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-63-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-65-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-67-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-71-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-69-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-73-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-75-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-77-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-79-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-81-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-83-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-85-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-87-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-89-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-91-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-93-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-95-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger
behavioral2/memory/3036-97-0x0000000005680000-0x00000000056B3000-memory.dmp	family_snakekeylogger

Drops startup file 1 IoCs

Processes:

unprickled.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\unprickled.vbs unprickled.exe
Executes dropped EXE 1 IoCs

Processes:

unprickled.exe

pid process

1152 unprickled.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\unprickled.vbs	unprickled.exe

pid	process
1152	unprickled.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

33 checkip.dyndns.org

flow	ioc
33	checkip.dyndns.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Glagolitic\unprickled.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

unprickled.exe

description pid process target process

PID 1152 set thread context of 3036 1152 unprickled.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3036 RegSvcs.exe
3036 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

unprickled.exe

pid process

1152 unprickled.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3036 RegSvcs.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

FATEYU07655700000.exeunprickled.exe

pid process

1328 FATEYU07655700000.exe
1328 FATEYU07655700000.exe
1152 unprickled.exe
1152 unprickled.exe
1152 unprickled.exe
1152 unprickled.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

FATEYU07655700000.exeunprickled.exe

pid process

1328 FATEYU07655700000.exe
1328 FATEYU07655700000.exe
1152 unprickled.exe
1152 unprickled.exe
1152 unprickled.exe
1152 unprickled.exe

description	pid	process	target process
PID 1152 set thread context of 3036	1152	unprickled.exe	RegSvcs.exe

pid	process
3036	RegSvcs.exe
3036	RegSvcs.exe

pid	process
1152	unprickled.exe

description	pid	process
Token: SeDebugPrivilege	3036	RegSvcs.exe

pid	process
1328	FATEYU07655700000.exe
1328	FATEYU07655700000.exe
1152	unprickled.exe
1152	unprickled.exe
1152	unprickled.exe
1152	unprickled.exe

pid	process
1328	FATEYU07655700000.exe
1328	FATEYU07655700000.exe
1152	unprickled.exe
1152	unprickled.exe
1152	unprickled.exe
1152	unprickled.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

FATEYU07655700000.exeunprickled.exe

description	pid	process	target process
PID 1328 wrote to memory of 1152	1328	FATEYU07655700000.exe	unprickled.exe
PID 1328 wrote to memory of 1152	1328	FATEYU07655700000.exe	unprickled.exe
PID 1328 wrote to memory of 1152	1328	FATEYU07655700000.exe	unprickled.exe
PID 1152 wrote to memory of 3036	1152	unprickled.exe	RegSvcs.exe
PID 1152 wrote to memory of 3036	1152	unprickled.exe	RegSvcs.exe
PID 1152 wrote to memory of 3036	1152	unprickled.exe	RegSvcs.exe
PID 1152 wrote to memory of 3036	1152	unprickled.exe	RegSvcs.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\FATEYU07655700000.exe
"C:\Users\Admin\AppData\Local\Temp\FATEYU07655700000.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Glagolitic\unprickled.exe
"C:\Users\Admin\AppData\Local\Temp\FATEYU07655700000.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\FATEYU07655700000.exe"
3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Glagolitic\unprickled.exe
Filesize
109.1MB

MD5
5bfb12321db7d6c010ed540bfe595d01

SHA1
a070820029ad7c37273c750211185d84199a6754

SHA256
77d5f3f148938712abfe1a13c9b5f8543ababaf23c2ad9d59395205b91847b6d

SHA512
c6126119b55e7e163412f1b7b5dd214f49e58ed37e6c63dd23cb31fb7a88ba37b0e337989d12f511d8c6d81a4ed10cba5eabdebb442bf1eeb3ab0cb9b4882834

Download Submit
C:\Users\Admin\AppData\Local\Temp\scroll
Filesize
224KB

MD5
db13b8e3b7361444f85d6647a4a9da30

SHA1
b8a5eebbcb6e2ed8d61bfb1ca0eaf54ed01bf8d7

SHA256
25a0381f9b3e6c6f654d97b786a115888b4fb8496060c2ff23488a082767c4eb

SHA512
778f988e0bc5724453b08514996bcad1499a5449d75a0124048b5c10605e2002d85aed4e7494ff022a8a0f9b9b503daea3a91a1a1d08465baed18460610ccdb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\windigos
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1328-10-0x0000000004030000-0x0000000004034000-memory.dmp

Filesize
16KB

Download
memory/3036-28-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-29-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-30-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-31-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-32-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/3036-33-0x0000000002FD0000-0x000000000300A000-memory.dmp

Filesize
232KB

Download
memory/3036-34-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3036-35-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/3036-36-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3036-37-0x0000000005680000-0x00000000056B8000-memory.dmp

Filesize
224KB

Download
memory/3036-38-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-39-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-41-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-43-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-45-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-47-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-49-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-51-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-53-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-55-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-57-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-59-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-61-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-63-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-65-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-67-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-71-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-69-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-73-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-75-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-77-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-79-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-81-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-83-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-85-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-87-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-89-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-91-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-93-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-95-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-97-0x0000000005680000-0x00000000056B3000-memory.dmp

Filesize
204KB

Download
memory/3036-626-0x0000000005790000-0x000000000582C000-memory.dmp

Filesize
624KB

Download
memory/3036-627-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3036-628-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3036-629-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/3036-630-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3036-631-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3036-632-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/3036-633-0x0000000006AB0000-0x0000000006B00000-memory.dmp

Filesize
320KB

Download
memory/3036-634-0x0000000006CD0000-0x0000000006E92000-memory.dmp

Filesize
1.8MB

Download
memory/3036-635-0x0000000006BA0000-0x0000000006C32000-memory.dmp

Filesize
584KB

Download
memory/3036-636-0x0000000006B70000-0x0000000006B7A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads