snakekeylogger | 5f69af27f78dbefe180e5a2e73d4544a4eeffacf078f57e2b26e481333b24f5d

General

Target

nuevo pedido.exe
Size

718KB
MD5

dc1317eb10b6a85ccc468e5c3c4871af
SHA1

21805ffb7deccb435317abc3f7bbc79c7447a644
SHA256

396d5ef9ac6eeb363625a3969b1c428389e29e06b70698c2addec8456b8a1843
SHA512

933debebd6c85be54a1ad253b9792e1458a05cddb53d6f03b517ec822896f82d7e313bf8dce8b480590118161abaee6fa99d11512f6ac4e1b897a76628dfce39
SSDEEP

12288:ZaMv62XP/91H3UB7yiJ2tzAlld0JpZuJKl5w:ZaMvZEtyiCAlSZuol

Score

10^/10

snakekeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
50.31.176.103
Port:
21
Username:
[email protected]
Password:
HW=f09RQ-BL1

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://50.31.176.103/
Port:
21
Username:
[email protected]
Password:
HW=f09RQ-BL1

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

resource	yara_rule
behavioral1/memory/3048-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3048-30-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3048-29-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3048-28-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3048-25-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe
1724	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 3048	3068	nuevo pedido.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nuevo pedido.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3068	nuevo pedido.exe
3068	nuevo pedido.exe
1724	powershell.exe
2640	powershell.exe
3048	MSBuild.exe
3048	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	nuevo pedido.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	3048	MSBuild.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2640	3068	nuevo pedido.exe	30
PID 3068 wrote to memory of 2640	3068	nuevo pedido.exe	30
PID 3068 wrote to memory of 2640	3068	nuevo pedido.exe	30
PID 3068 wrote to memory of 2640	3068	nuevo pedido.exe	30
PID 3068 wrote to memory of 1724	3068	nuevo pedido.exe	32
PID 3068 wrote to memory of 1724	3068	nuevo pedido.exe	32
PID 3068 wrote to memory of 1724	3068	nuevo pedido.exe	32
PID 3068 wrote to memory of 1724	3068	nuevo pedido.exe	32
PID 3068 wrote to memory of 2568	3068	nuevo pedido.exe	34
PID 3068 wrote to memory of 2568	3068	nuevo pedido.exe	34
PID 3068 wrote to memory of 2568	3068	nuevo pedido.exe	34
PID 3068 wrote to memory of 2568	3068	nuevo pedido.exe	34
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36
PID 3068 wrote to memory of 3048	3068	nuevo pedido.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\nuevo pedido.exe
"C:\Users\Admin\AppData\Local\Temp\nuevo pedido.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\nuevo pedido.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sXihKbNNLAFiO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sXihKbNNLAFiO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4940.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4940.tmp

Filesize
1KB

MD5
7d7b7cfe655f2f02ab3e311a816f35cb

SHA1
552114e052fc002f8a19ef924565f73f995af07c

SHA256
6c576d8f75ac1abe3ce0749701a621b5f257f91e3cba6003cd9aad50ee56c188

SHA512
d8e75810374fa7d4f3a1da727a25a4723391e0a3d0ce78cbd29847e68c01280aa2b2b09645f6988507cf59ec1bc2ebd5f73a91bb1816a8ad9626a212c3d0f8d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
11ff6e65255e48cb583f3044d236614a

SHA1
28adf508a3ebdb6ddf5223862c01bcfc7f050d40

SHA256
f6861d8c0dddb7783d40bb7248df0adfe63d639f194200723a1f750ef3dc11c9

SHA512
5c62454a12999cbeb47f1c01baa299cea59348578ac62b0ffb7192bf587c56b884229e173cb5565912dbae05a90adcf13b17e1d23894d95ffd9246c905e50ffe

Download Submit
memory/3048-28-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3048-30-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3048-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3048-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3048-25-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3048-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3048-29-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3048-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3068-6-0x0000000004B70000-0x0000000004BDC000-memory.dmp

Filesize
432KB

Download
memory/3068-1-0x0000000000D10000-0x0000000000DCA000-memory.dmp

Filesize
744KB

Download
memory/3068-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/3068-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-3-0x00000000003D0000-0x00000000003E2000-memory.dmp

Filesize
72KB

Download
memory/3068-5-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/3068-4-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/3068-31-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads