snakekeylogger | 68930f6edf4c46201668adc5b0f91008e1914b6fdb60742c0d60c9b5162a3acf

Analysis

max time kernel
136s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SIPARIS-270624.exe
Size

26KB
MD5

3a518d667edf1b7e38bef02c9aa2e74e
SHA1

0ea5ca2b196f96fa6d6112c3771f3c132c124ff9
SHA256

68930f6edf4c46201668adc5b0f91008e1914b6fdb60742c0d60c9b5162a3acf
SHA512

648d9e2fda98fd2e47342885c7a250f1e37353c5f0cf9ee6027c0ffa073e57cc34574bab40d2291e7af0b66a3da014f16858d7be9d9542c28786133b5d7004a9
SSDEEP

384:nqJNd2S1m0rRdZaE585ywpUWFo8nwpcEBbW1F3HSR5ScyuHkZhpxsFreAxzy:4m0rDVu5yGfo8kGevcpxs3zy

Score

10^/10

snakekeylogger collection keylogger persistence spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.oleonidas.gr
Port:
587
Username:
[email protected]
Password:
fT@*Lj)MTz0y
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Snake Keylogger payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/5112-4905-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

resource	yara_rule
behavioral2/memory/5112-4905-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

SIPARIS-270624.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SIPARIS-270624.exe
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SIPARIS-270624.exe
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SIPARIS-270624.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

SIPARIS-270624.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ifvhih = "C:\\Users\\Admin\\AppData\\Roaming\\Ifvhih.exe"	SIPARIS-270624.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

44 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SIPARIS-270624.exe

description pid process target process

PID 3128 set thread context of 5112 3128 SIPARIS-270624.exe SIPARIS-270624.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SIPARIS-270624.exe

pid process

5112 SIPARIS-270624.exe
5112 SIPARIS-270624.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SIPARIS-270624.exeSIPARIS-270624.exe

description pid process

Token: SeDebugPrivilege 3128 SIPARIS-270624.exe
Token: SeDebugPrivilege 3128 SIPARIS-270624.exe
Token: SeDebugPrivilege 5112 SIPARIS-270624.exe

flow	ioc
44	checkip.dyndns.org

description	pid	process	target process
PID 3128 set thread context of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe

pid	process
5112	SIPARIS-270624.exe
5112	SIPARIS-270624.exe

description	pid	process
Token: SeDebugPrivilege	3128	SIPARIS-270624.exe
Token: SeDebugPrivilege	3128	SIPARIS-270624.exe
Token: SeDebugPrivilege	5112	SIPARIS-270624.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SIPARIS-270624.exe

description	pid	process	target process
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe
PID 3128 wrote to memory of 5112	3128	SIPARIS-270624.exe	SIPARIS-270624.exe

outlook_office_path 1 IoCs

Processes:

SIPARIS-270624.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 SIPARIS-270624.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SIPARIS-270624.exe

outlook_win_path 1 IoCs

Processes:

SIPARIS-270624.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SIPARIS-270624.exe

C:\Users\Admin\AppData\Local\Temp\SIPARIS-270624.exe
"C:\Users\Admin\AppData\Local\Temp\SIPARIS-270624.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128

C:\Users\Admin\AppData\Local\Temp\SIPARIS-270624.exe
"C:\Users\Admin\AppData\Local\Temp\SIPARIS-270624.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5112

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SIPARIS-270624.exe.log
Filesize
1KB

MD5
f3eb81974dc5933681e933f07209ff5f

SHA1
7af8cae0f1d03e82daaf784df9886705685baac7

SHA256
e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

SHA512
d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

Download Submit
memory/3128-0-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

Filesize
4KB

Download
memory/3128-1-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/3128-2-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/3128-3-0x0000000007420000-0x0000000007648000-memory.dmp

Filesize
2.2MB

Download
memory/3128-4-0x0000000007C40000-0x00000000081E4000-memory.dmp

Filesize
5.6MB

Download
memory/3128-5-0x0000000007890000-0x0000000007922000-memory.dmp

Filesize
584KB

Download
memory/3128-17-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-19-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-43-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-41-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-57-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-69-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-67-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-65-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-61-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-59-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-63-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-55-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-53-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-49-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-47-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-45-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-39-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-37-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-35-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-51-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-29-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-33-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-31-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-27-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-25-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-15-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-13-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-11-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-7-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-23-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-21-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-9-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-6-0x0000000007420000-0x0000000007641000-memory.dmp

Filesize
2.1MB

Download
memory/3128-4892-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/3128-4894-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Filesize
304KB

Download
memory/3128-4893-0x0000000005C50000-0x0000000005CB2000-memory.dmp

Filesize
392KB

Download
memory/3128-4895-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

Filesize
4KB

Download
memory/3128-4896-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/3128-4897-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/3128-4898-0x00000000056B0000-0x0000000005704000-memory.dmp

Filesize
336KB

Download
memory/3128-4903-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/5112-4904-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/5112-4905-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/5112-4906-0x00000000055B0000-0x000000000564C000-memory.dmp

Filesize
624KB

Download
memory/5112-4907-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download
memory/5112-4908-0x00000000069E0000-0x0000000006A30000-memory.dmp

Filesize
320KB

Download
memory/5112-4909-0x0000000006C00000-0x0000000006DC2000-memory.dmp

Filesize
1.8MB

Download
memory/5112-4910-0x0000000006AB0000-0x0000000006ABA000-memory.dmp

Filesize
40KB

Download
memory/5112-4911-0x0000000074E80000-0x0000000075630000-memory.dmp

Filesize
7.7MB

Download