snakekeylogger | 6aa3f6881dc4470bc2cd9488d3cbf752793cc27e390fb4f4071da5b2fb4e4d33

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NYMPH THETIS V2402B.exe
Size

537KB
MD5

2bb3a0278b348e2111eb424e5d554081
SHA1

c5e880229775d114cc5d4560f41360d999e7461a
SHA256

1da9c25bf39cdfdf6d448c0f4823db54848fc65e1ef41656900479f83013aa54
SHA512

b94412e774b3cb0fb78cc7e0abaf2645f9077635b9d7fb730c6942918c02624911db35ba55ccabcec079bbc9d15ee33997a28c7b01dc9350000971a924a3798a
SSDEEP

12288:/JREc4DmRRAEQbw5Is89pOpRiWsLJv/v+SLuSn:T/bYU5DCpOp8zFv/XLB

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.valleycountysar.org
Port:
587
Username:
[email protected]
Password:
DKw(r0%wpbd]

http://103.130.147.85

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1376-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral3/memory/1376-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral3/memory/1376-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral3/memory/1376-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral3/memory/1376-7-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2424 cmd.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

NYMPH THETIS V2402B.exe

description pid process target process

PID 2196 set thread context of 1376 2196 NYMPH THETIS V2402B.exe NYMPH THETIS V2402B.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

NYMPH THETIS V2402B.exe

pid process

1376 NYMPH THETIS V2402B.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NYMPH THETIS V2402B.exe

description pid process

Token: SeDebugPrivilege 1376 NYMPH THETIS V2402B.exe

pid	process
2424	cmd.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 2196 set thread context of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe

pid	process
1376	NYMPH THETIS V2402B.exe

description	pid	process
Token: SeDebugPrivilege	1376	NYMPH THETIS V2402B.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

NYMPH THETIS V2402B.exeNYMPH THETIS V2402B.execmd.exe

description	pid	process	target process
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 2196 wrote to memory of 1376	2196	NYMPH THETIS V2402B.exe	NYMPH THETIS V2402B.exe
PID 1376 wrote to memory of 2424	1376	NYMPH THETIS V2402B.exe	cmd.exe
PID 1376 wrote to memory of 2424	1376	NYMPH THETIS V2402B.exe	cmd.exe
PID 1376 wrote to memory of 2424	1376	NYMPH THETIS V2402B.exe	cmd.exe
PID 1376 wrote to memory of 2424	1376	NYMPH THETIS V2402B.exe	cmd.exe
PID 2424 wrote to memory of 2968	2424	cmd.exe	choice.exe
PID 2424 wrote to memory of 2968	2424	cmd.exe	choice.exe
PID 2424 wrote to memory of 2968	2424	cmd.exe	choice.exe
PID 2424 wrote to memory of 2968	2424	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\NYMPH THETIS V2402B.exe
"C:\Users\Admin\AppData\Local\Temp\NYMPH THETIS V2402B.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\NYMPH THETIS V2402B.exe
"C:\Users\Admin\AppData\Local\Temp\NYMPH THETIS V2402B.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\NYMPH THETIS V2402B.exe"
3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-5-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-21-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/1376-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1376-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-20-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/1376-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-19-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/1376-17-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/1376-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1376-16-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/2196-0-0x00000000748DE000-0x00000000748DF000-memory.dmp

Filesize
4KB

Download
memory/2196-1-0x0000000000FB0000-0x000000000103C000-memory.dmp

Filesize
560KB

Download
memory/2196-18-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/2196-2-0x00000000006E0000-0x0000000000734000-memory.dmp

Filesize
336KB

Download
memory/2196-4-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/2196-3-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download