snakekeylogger | f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe
Size 389KB
Sample240710-c3j2astdph
SHA256 f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0
MD5 016b555049364f09f3d2f58fe88c28f7
SHA1 48893b18559daa8392ff371117f799113c81c90d
SHA512 15ce409cdb879c30d14d6211127fa0d8f7cc22611b3c20906f70ef5da059dd769953441e4cd466b2b6c3f7a6124786f0c6f981abc75812f2a99d452bd1d3d586
SSDEEP 6144:9M23AbpBWzrsx8NjZc+2xFLHUxxf5WMG8FtObeYv5JuvWLWC32jTMA3hJCQNUs:vGpQzQ8cLxFQtdG8Ftqvzh9pKJfNb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger collection execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7479517689:AAFZXzeEulm16gwWbLqx5RMoTeKEfX7e5jQ/sendMessage?chat_id=7071568333

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

resource	yara_rule
behavioral1/memory/2720-42-0x0000000000500000-0x0000000001562000-memory.dmp	family_snakekeylogger
behavioral1/memory/2720-43-0x0000000000500000-0x0000000000526000-memory.dmp	family_snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2540	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	drive.google.com
4	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2720	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2540	powershell.exe
2720	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2540 set thread context of 2720	2540	powershell.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
2540	powershell.exe
2720	wab.exe
2720	wab.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2540	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2720	wab.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2540	2052	f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe	28
PID 2052 wrote to memory of 2540	2052	f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe	28
PID 2052 wrote to memory of 2540	2052	f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe	28
PID 2052 wrote to memory of 2540	2052	f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe	28
PID 2540 wrote to memory of 2720	2540	powershell.exe	31
PID 2540 wrote to memory of 2720	2540	powershell.exe	31
PID 2540 wrote to memory of 2720	2540	powershell.exe	31
PID 2540 wrote to memory of 2720	2540	powershell.exe	31
PID 2540 wrote to memory of 2720	2540	powershell.exe	31
PID 2540 wrote to memory of 2720	2540	powershell.exe	31

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wab.exe

C:\Users\Admin\AppData\Local\Temp\f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe
"C:\Users\Admin\AppData\Local\Temp\f8aa18d4254a618c058dda0a2be332707f305795953a26402e7b5f791b778bf0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Forsvrgelsen=Get-Content 'C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Sperlingkasserne.Gla';$Decubitus=$Forsvrgelsen.SubString(65564,3);.$Decubitus($Forsvrgelsen)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Presenile.Tel

Path C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Presenile.Tel
Size 330KB
SHA256 38c27304ea5dcdcdbf5214a38989559b4f2feb79b73d680ec96cf2e9e220225d
MD5 67bfad28d1127c53a9aac5c51b3b77b8
SHA1 896af109b830f91baa527847b2cf968cba28b771
SHA512 8eb928e4731dda023c4b253539cd5e6246bcdc2bdbbe74e2f745f129c829a64b04c7d746630eb66a504b417332ea42b6d9bfd987f4704cb51660750fbe467b8b
SSDEEP 6144:LRPruCQrdK9y/AXcmqoEwO1En9Cddcpbz2a6KnCZnu77JJE:dPJQrYyYMmqZ1i9CXAyf9ZnQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sperlingkasserne.Gla

Path C:\Users\Admin\AppData\Roaming\annekskirkers\dommedagens\nonmenial\Sperlingkasserne.Gla
Size 64KB
SHA256 92eca1cfe870c436907085d7d2d85ea69c5596d456a98224937d631cfaf4adc6
MD5 c9035c38abb2f8b3e1255a2320926c2b
SHA1 29ee2663a1f9e8c907791957558b79dff166413c
SHA512 9b1f7655ec40cd92a873547bf7b8b03de824ee53bf2cbd516ec245e3cbc385e6659ce61ce5c94c1460877d697a42fbf1ee65db3abed1474c7aeec233208e89f7
SSDEEP 1536:vs8a2m7EDVyBpJ+Gmyr/vyzY3Pr8SXFkcsBs9KmjfybPuqgQZhqM7GNn2:Eb2mIDu+GmyjE/SX+Bs9Kmj6bPgQZfGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2540-18-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2540-13-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2540-15-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2540-14-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2540-11-0x0000000073611000-0x0000000073612000-memory.dmp

Download

memory/2540-12-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2540-20-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2540-21-0x00000000065C0000-0x000000000749B000-memory.dmp

Download

memory/2540-22-0x0000000073610000-0x0000000073BBB000-memory.dmp

Download

memory/2720-42-0x0000000000500000-0x0000000001562000-memory.dmp

Download

memory/2720-43-0x0000000000500000-0x0000000000526000-memory.dmp

Download