snakekeylogger | c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb

General

Target

c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
Size

708KB
MD5

cda26758d383d4440f407947e1bc38fe
SHA1

f159f961491285f6f02e483f65644fc8e145090e
SHA256

c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb
SHA512

45d6cf1a76371ce275ebadb96e24ef966baacddc2b686fdb10634380068e423d65b00de5d0d00ac2e2aea95b52ea479341d824103453b3a21be6f3d9ddaae34d
SSDEEP

12288:ft8fURnHb+Qv6HNbwV4dZmcCa5c986GQbsXnfkTys3XpApPE4tan1bZKfURnHbpy:qMRHPv6tkVGZBJI86G8WnfmmE4t/MRHY

Score

10^/10

snakekeylogger collection discovery execution keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.gzdled.com.tr
Port:
587
Username:
[email protected]
Password:
Gozdeled1048
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

resource	yara_rule
behavioral1/memory/2808-30-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-29-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-28-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-25-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe
2180	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	reallyfreegeoip.org
4	checkip.dyndns.org
9	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
2808	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
2180	powershell.exe
2760	powershell.exe
2808	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
Token: SeDebugPrivilege	2808	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2180	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	30
PID 1968 wrote to memory of 2180	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	30
PID 1968 wrote to memory of 2180	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	30
PID 1968 wrote to memory of 2180	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	30
PID 1968 wrote to memory of 2760	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	32
PID 1968 wrote to memory of 2760	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	32
PID 1968 wrote to memory of 2760	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	32
PID 1968 wrote to memory of 2760	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	32
PID 1968 wrote to memory of 2856	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	34
PID 1968 wrote to memory of 2856	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	34
PID 1968 wrote to memory of 2856	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	34
PID 1968 wrote to memory of 2856	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	34
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36
PID 1968 wrote to memory of 2808	1968	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe

C:\Users\Admin\AppData\Local\Temp\c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
"C:\Users\Admin\AppData\Local\Temp\c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tjvxuavKFXO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tjvxuavKFXO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC005.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe
  "C:\Users\Admin\AppData\Local\Temp\c2faf91bcc8b5f17406999a077c5836086be968b46ad6ff855f99f22dbb41adb.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC005.tmp

Filesize
1KB

MD5
cafe70a81401ead12ad53e0a168c0783

SHA1
0b9cc05bdb47e69a845d0319e486886cf80864ca

SHA256
bb132637d3affc550221e8f856f9ec84d9b9602227bbb0428d7e7c83b2b35f35

SHA512
4d1299e198ea1b4de4c8a29e5d6c7474c99c3e174044c34dc6f4f6162c7ef6f3f9d88e1ef373b0d1b5101de62dbc658f01245d82a1df75230980f92e21c5aed2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I242RWOEDE6KFEBZ0349.temp

Filesize
7KB

MD5
f7412f7fcc02084cbe53b2740f432225

SHA1
040b23029e3ed9b39247b8c9ac81e798f7eef4a6

SHA256
7c802d83da2ad8dd49b8b077c0bd0687bbca6a7a35b60531703cd648efe6785a

SHA512
185270e49a62888b9f2355d33cc9729d977490ea673023c9bc94753794ad78441f7af29ef4dd9c258a43b75f499db0366e9a632a730883da6a9ded8dac72cec9

Download Submit
memory/1968-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/1968-31-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1968-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/1968-5-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1968-6-0x0000000000440000-0x00000000004AC000-memory.dmp

Filesize
432KB

Download
memory/1968-2-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1968-1-0x0000000001260000-0x0000000001314000-memory.dmp

Filesize
720KB

Download
memory/1968-3-0x00000000004F0000-0x000000000050E000-memory.dmp

Filesize
120KB

Download
memory/2808-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-29-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-28-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2808-25-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-30-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads