snakekeylogger | eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
Size

546KB
MD5

06c135c6806d204db854b2b303f711e4
SHA1

7034a07bcd5c2855c2a906f1c96a0490dda51a26
SHA256

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce
SHA512

b935c9c0415a7abc778d3cf0b374a2604ebd0eb33b3223412c9ffc9d320b3cffed381b0d98d4350bdd0af05f4b7c3f050b90305d102e36c60891a9bec9a6ee51
SSDEEP

12288:rpaLt72wtNGZYqnDLPM/en5IDxDhzkz6C3jYCNVyvUGdABV:KqDLTQFW93jYCqAB

Score

10^/10

snakekeylogger collection execution keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://ftp.darwishgruop.com/
Port:
21
Username:
[email protected]
Password:
Uvob2G1Tc73ZCus02X

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2636-22-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2636-27-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2636-29-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2636-28-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2636-24-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2980 powershell.exe
2592 powershell.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2980	powershell.exe
2592	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

description	pid	process	target process
PID 2464 set thread context of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2620 schtasks.exe

pid	process
2620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exeeebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exepowershell.exepowershell.exe

pid	process
2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
2636	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
2980	powershell.exe
2592	powershell.exe
2636	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exeeebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
Token: SeDebugPrivilege	2636	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

description	pid	process	target process
PID 2464 wrote to memory of 2980	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2980	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2980	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2980	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2592	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2592	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2592	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2592	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	powershell.exe
PID 2464 wrote to memory of 2620	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	schtasks.exe
PID 2464 wrote to memory of 2620	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	schtasks.exe
PID 2464 wrote to memory of 2620	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	schtasks.exe
PID 2464 wrote to memory of 2620	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	schtasks.exe
PID 2464 wrote to memory of 2892	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2892	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2892	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2892	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2500	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2500	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2500	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2500	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
PID 2464 wrote to memory of 2636	2464	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

outlook_office_path 1 IoCs

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

outlook_win_path 1 IoCs

Processes:

eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe

C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
"C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NPARoYe.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NPARoYe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp512C.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
"C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe"
2⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
"C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe"
2⤵
PID:2500

C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe
"C:\Users\Admin\AppData\Local\Temp\eebcd1414319130f36bea1e6c8fd29750118b145dae2d094d8a9d6aac0c619ce.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp512C.tmp
Filesize
1KB

MD5
cf1b198247be1978b972716749c55c59

SHA1
ef7975eb66bb9b89e92a253b6271d9d4fd2a6d77

SHA256
a2e24218107ecf9cf19a542d56ef43daef7e92e2dec7446516908e803137cef2

SHA512
d017acbb4413d7f41c084281d359182d9e8025a58d0a28829de48318da70913608860721b646848f429574824115e2540fc86037dccc561a8f7126c4d7dafb89

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
524bd0c6849e270e7667ca214838381e

SHA1
b6d4cfd5b6af8b69a7ba7258a09a0a670659d797

SHA256
638c23cf922e02d48f20739e17bbc0318cf159449434d9cc7297e058436b00b9

SHA512
bfde1807c03d5b5fa0c28af37e85cd5a712edb70c6cb55c01d731ce0a8952a89e2f4d686e1eebc465de203ce8368ea37727641b0be8e4afecc4c546b36ec5d64

Download Submit
memory/2464-30-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2464-1-0x0000000000D00000-0x0000000000D8E000-memory.dmp

Filesize
568KB

Download
memory/2464-2-0x0000000074680000-0x0000000074D6E000-memory.dmp

Filesize
6.9MB

Download
memory/2464-3-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2464-4-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/2464-5-0x0000000005D00000-0x0000000005D68000-memory.dmp

Filesize
416KB

Download
memory/2464-0-0x000000007468E000-0x000000007468F000-memory.dmp

Filesize
4KB

Download
memory/2636-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2636-27-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2636-29-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2636-28-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2636-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-24-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2636-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2636-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download