snakekeylogger | 69b96339e1bfc4e64ff7b8c5af0a3f43055b149cdbac3d814db982e25b2a4357

General

Target

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
Size

651KB
MD5

bd1e1c32c0d45c1a6c0c70a8b83740e2
SHA1

9a33ffe797f9318289b10e41d4ed10d966cfd578
SHA256

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0
SHA512

534cc7c29dd7a15d6b8e29ba15c3a44baeb315f7826da19877d12052418899d9093403f2bd5800594d885e30ab7790fc1faea254d79fd42ed7f88beafed3947f
SSDEEP

12288:Ue69UNW+A0BroXA2u9pAxzJxj2hCGXbmBoznolq5Ic:Uer5rcu9gNxjMvrmBoznoMu

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3352-13-0x0000000000610000-0x000000000062C000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 checkip.dyndns.org

flow	ioc
17	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

description	pid	process	target process
PID 4428 set thread context of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

pid process

3352 bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

description pid process

Token: SeDebugPrivilege 3352 bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

pid	process
3352	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

description	pid	process
Token: SeDebugPrivilege	3352	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exebb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.execmd.exe

description	pid	process	target process
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 4428 wrote to memory of 3352	4428	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
PID 3352 wrote to memory of 3872	3352	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	cmd.exe
PID 3352 wrote to memory of 3872	3352	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	cmd.exe
PID 3352 wrote to memory of 3872	3352	bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe	cmd.exe
PID 3872 wrote to memory of 4984	3872	cmd.exe	choice.exe
PID 3872 wrote to memory of 4984	3872	cmd.exe	choice.exe
PID 3872 wrote to memory of 4984	3872	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
"C:\Users\Admin\AppData\Local\Temp\bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe
  "C:\Users\Admin\AppData\Local\Temp\bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0.exe.log

Filesize
706B

MD5
f8bcaf312de8591707436c1dcebba8e4

SHA1
a1269828e5f644601622f4a7a611aec8f2eda0b2

SHA256
f0f5a90777c70cdceea22bd66b33c1703a318acc45cb012d0b01585a1ac12b29

SHA512
3a714f5950584abbc94a27bbd4623bfc5acb1135c8c9fca4d74e70c8481b71ace7dbc1dfbf101dd07c76a050acfb4852f31dd57fc7ae196382336c5edc9e6413

Download Submit
memory/3352-15-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/3352-14-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3352-11-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/3352-13-0x0000000000610000-0x000000000062C000-memory.dmp

Filesize
112KB

Download
memory/4428-2-0x00000000052D0000-0x000000000531A000-memory.dmp

Filesize
296KB

Download
memory/4428-6-0x0000000005590000-0x000000000562C000-memory.dmp

Filesize
624KB

Download
memory/4428-7-0x00000000053F0000-0x00000000053F8000-memory.dmp

Filesize
32KB

Download
memory/4428-5-0x0000000005450000-0x00000000054E2000-memory.dmp

Filesize
584KB

Download
memory/4428-4-0x0000000005960000-0x0000000005F04000-memory.dmp

Filesize
5.6MB

Download
memory/4428-12-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4428-1-0x00000000746C0000-0x0000000074E70000-memory.dmp

Filesize
7.7MB

Download
memory/4428-3-0x00000000053A0000-0x00000000053B0000-memory.dmp

Filesize
64KB

Download
memory/4428-0-0x00000000008C0000-0x000000000096A000-memory.dmp

Filesize
680KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads