snakekeylogger | b4fab30e3e48d0b9f565b1ba0aeb34a9c340bc67e71b34cc24a96224ad2577e2

General

Target

a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
Size

414KB
MD5

7df48a735cf653a7cdfafdacfa18e9fe
SHA1

8392410562ae6bb1d8792f7e82cc78d334136c10
SHA256

a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7
SHA512

a3721db0f5abfed191975bac48d7d10f0ee34304e2384080fdb501b7ff45bbb9f58d805103c1fb340ae28e799befd49f4723548a1ca83cbbcc66d21518ee11c3
SSDEEP

6144:Hg0GgLaOwh3biYqc0kpScxhBryo0aVJchfoWUC8Qr+1vFZnyBTgwLr4h6/qA2ur:A0GgLCh3b/msfurawWq8Ntu/J

Score

10^/10

snakekeylogger defense_evasion discovery keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5231087432:AAGpDNiylOvJ21KejYNZPyeLSQa-u4GJlU4/sendMessage?chat_id=1474445387

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/2688-15-0x0000000000090000-0x00000000000B6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2688-16-0x0000000000090000-0x00000000000B6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2688-23-0x0000000000090000-0x00000000000B6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2688-32-0x0000000000090000-0x00000000000B6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2688-27-0x0000000000090000-0x00000000000B6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2688-22-0x0000000000090000-0x00000000000B6000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

System Binary Proxy Execution: InstallUtil 1 TTPs 2 IoCs

Abuse InstallUtil to proxy execution of malicious code.

defense_evasion

InstallUtil

T1218.004

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\InstallUtil.exe	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	InstallUtil.exe

Loads dropped DLL 6 IoCs

pid	Process
2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe
2880	WerFault.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2112 set thread context of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	2688	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
2688	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
Token: SeDebugPrivilege	2688	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2112 wrote to memory of 2688	2112	a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe	30
PID 2688 wrote to memory of 2880	2688	InstallUtil.exe	31
PID 2688 wrote to memory of 2880	2688	InstallUtil.exe	31
PID 2688 wrote to memory of 2880	2688	InstallUtil.exe	31
PID 2688 wrote to memory of 2880	2688	InstallUtil.exe	31

C:\Users\Admin\AppData\Local\Temp\a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe
"C:\Users\Admin\AppData\Local\Temp\a52d9b136a8a439dab2da1d870ab2a75d2847817191bc785e3894c95b9c9eff7.exe"
1⤵
- System Binary Proxy Execution: InstallUtil
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1540
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

1

T1218

InstallUtil

1

T1218.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\InstallUtil.exe

Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
memory/2112-0-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x0000000001250000-0x00000000012BE000-memory.dmp

Filesize
440KB

Download
memory/2112-2-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-3-0x0000000000990000-0x00000000009C2000-memory.dmp

Filesize
200KB

Download
memory/2112-4-0x0000000000350000-0x0000000000366000-memory.dmp

Filesize
88KB

Download
memory/2112-6-0x000000007433E000-0x000000007433F000-memory.dmp

Filesize
4KB

Download
memory/2112-7-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-8-0x0000000000AD0000-0x0000000000AEA000-memory.dmp

Filesize
104KB

Download
memory/2112-9-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Filesize
24KB

Download
memory/2112-33-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-19-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-14-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-22-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-15-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-23-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-32-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-27-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-16-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-35-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-34-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-13-0x0000000000090000-0x00000000000B6000-memory.dmp

Filesize
152KB

Download
memory/2688-36-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-42-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-43-0x0000000074330000-0x0000000074A1E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing