snakekeylogger | 7ea280179e136a1a753cddc73123975a77ac32ddf48ac9a033513dfe99a9a52e

General

Target

1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exe
Size

269KB
MD5

3c707a76b1c6c53e381e5da078ce8997
SHA1

6ac3522f2ca5016163e4628dd34540ac9c265d98
SHA256

1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c
SHA512

61972ebeb909ef6fd0b06c4a3c0dd253214a374da8be8f3992a9bd083e68c2eab1a98db4f28c2d5c4c1017182b738674bdfa64b7e0c6d7b00819b65e00d275bd
SSDEEP

6144:KYa6wCcfGAtjzSSWr+LL97alHLpS9pzEYzUUG3Z:KYGCcOAtjzSbrYwlHLYGU0

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6180860165:AAH5meoxRqYOnd7z0M_zkiqQ7pmOf_hbrUY/sendMessage?chat_id=6077046490

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/432-9-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-11-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-12-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-14-0x0000000000400000-0x0000000000438000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-16-0x00000000022F0000-0x0000000002316000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-18-0x0000000004A60000-0x0000000004A70000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-27-0x0000000004A60000-0x0000000004A70000-memory.dmp	family_snakekeylogger
behavioral2/memory/432-29-0x0000000004A60000-0x0000000004A70000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

Processes:

hzwixydpga.exehzwixydpga.exe

pid process

4396 hzwixydpga.exe
432 hzwixydpga.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4396	hzwixydpga.exe
432	hzwixydpga.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

hzwixydpga.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hzwixydpga.exe
Key opened	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hzwixydpga.exe
Key opened	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hzwixydpga.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

hzwixydpga.exe

description pid process target process

PID 4396 set thread context of 432 4396 hzwixydpga.exe hzwixydpga.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

hzwixydpga.exe

pid process

432 hzwixydpga.exe
432 hzwixydpga.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

hzwixydpga.exe

pid process

4396 hzwixydpga.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hzwixydpga.exe

description pid process

Token: SeDebugPrivilege 432 hzwixydpga.exe

flow	ioc
21	checkip.dyndns.org

description	pid	process	target process
PID 4396 set thread context of 432	4396	hzwixydpga.exe	hzwixydpga.exe

pid	process
432	hzwixydpga.exe
432	hzwixydpga.exe

pid	process
4396	hzwixydpga.exe

description	pid	process
Token: SeDebugPrivilege	432	hzwixydpga.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exehzwixydpga.exe

description	pid	process	target process
PID 2672 wrote to memory of 4396	2672	1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exe	hzwixydpga.exe
PID 2672 wrote to memory of 4396	2672	1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exe	hzwixydpga.exe
PID 2672 wrote to memory of 4396	2672	1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exe	hzwixydpga.exe
PID 4396 wrote to memory of 432	4396	hzwixydpga.exe	hzwixydpga.exe
PID 4396 wrote to memory of 432	4396	hzwixydpga.exe	hzwixydpga.exe
PID 4396 wrote to memory of 432	4396	hzwixydpga.exe	hzwixydpga.exe
PID 4396 wrote to memory of 432	4396	hzwixydpga.exe	hzwixydpga.exe

outlook_office_path 1 IoCs

Processes:

hzwixydpga.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hzwixydpga.exe

outlook_win_path 1 IoCs

Processes:

hzwixydpga.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	hzwixydpga.exe

C:\Users\Admin\AppData\Local\Temp\1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exe
"C:\Users\Admin\AppData\Local\Temp\1179340120d15da615c756d150ef5e5416bafe41ccdc0207da63f8877177194c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe
"C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe" C:\Users\Admin\AppData\Local\Temp\ilwxnyiqg.hb
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4396

C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe
"C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hzwixydpga.exe
Filesize
58KB

MD5
a125ad645e6565297bab29355475dbad

SHA1
0c1b472760f288c6a31181165f2ceef63ea69fae

SHA256
0c69de10bce3bbdea0a2db0caf5a79b3864d4d4da59bcae89f08e5b468350681

SHA512
e1dbbfcd03c5f531dd03a0b929249c44fb85838de057c8983de7ce243dd4fe5393c50d4ddf22aa15d4817c1fddb53b4764bc85f3bac47962809c7f74a69a55fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\ilwxnyiqg.hb
Filesize
5KB

MD5
0119e9534874e35a32279d5ab9b3239a

SHA1
364263c747be1d2640a5b3982c30f1863cebb87e

SHA256
6a3cec03ff6ec0194b734fe3587dfcb098e130e7e8fc28e2045068baee0fcd4c

SHA512
1c123319a7d39000cb6bb12af67655b7da8fca8468f36a7d0481daf54ab988525e9c5290f5748b2ccb71c6ea304265d081f6faf283e94bed0a47931a2eedc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\pavmoctl.tdp
Filesize
226KB

MD5
bfa517104bedf8d944ead133b9243ed2

SHA1
c92829f90ffd011a7d1b0fe96898c905b18198c5

SHA256
62d5ba86793e5b349ce8329e9d07ef79de5107b66894a548315cd9fa0db4aa41

SHA512
af4876baa4d90475b2ecc43c0932d43eb6eea070f4e2a8ee6857df486dc4a9983243bd01e091fb481e52736c02dcfd78b07309bac291e390beff56a3b494d801

Download Submit
memory/432-17-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/432-19-0x0000000004A70000-0x0000000005014000-memory.dmp

Filesize
5.6MB

Download
memory/432-11-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/432-12-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/432-14-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/432-16-0x00000000022F0000-0x0000000002316000-memory.dmp

Filesize
152KB

Download
memory/432-15-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/432-30-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/432-18-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/432-9-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/432-20-0x00000000049C0000-0x0000000004A5C000-memory.dmp

Filesize
624KB

Download
memory/432-21-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/432-22-0x0000000005C90000-0x0000000005D22000-memory.dmp

Filesize
584KB

Download
memory/432-23-0x0000000005DD0000-0x0000000005F92000-memory.dmp

Filesize
1.8MB

Download
memory/432-24-0x0000000005DB0000-0x0000000005DBA000-memory.dmp

Filesize
40KB

Download
memory/432-26-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/432-27-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/432-29-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/4396-7-0x0000000000580000-0x0000000000582000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads