Extracted

• • Target

    5f7ede06fa8da808f891e29fcfc533fcab3f7e9bc02ad68d0e5b24fe006fcbe5.xls

  • Size

    640KB

  • MD5

    20e619e98752c941405d8bc0c66242b9

  • SHA1

    0320eeb4e91a97d2d78f1ddb196ff09ca7a95da0

  • SHA256

    5f7ede06fa8da808f891e29fcfc533fcab3f7e9bc02ad68d0e5b24fe006fcbe5

  • SHA512

    1a7f5cb0e1af193d9e6e07b4653648d607c4e931b32be475c0808fdd33a55a1e4257db456f8bda32f69ee09e07ba48248163127b72939eca17619110e997bdc2

  • SSDEEP

    12288:3S6nskrDE0NvKwm3HzxoO1e1ic6yWK0VceVnV2EVS7IIM:3S6nrNvIoOcl637rnV2Ey/M

  Score

  10^/10

  snakekeyloggercollectiondefense_evasiondiscoveryexecutionkeyloggerstealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Evasion via Device Credential Deployment

    defense_evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2