snakekeylogger | 1cb8fe9e0457c4b0f986f45462b5c35c595374f045a52f0e19a40a9bd8b79195

Analysis

max time kernel
122s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-06-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA your client has an outstanding amount of 60.690€..exe
Size

2.0MB
MD5

92c83a8f67d64aef2b94f1b79ad2f538
SHA1

a169688d6044aec9d97407f4350316d238cf17e0
SHA256

9cb0c51bde1990ee8ac844aba1a8c1f18cc22e8a573f3363214afff4c3959f5f
SHA512

3529dbd000605b6553c22e8c4b2f22aedbb82893786d07a0a41e5f2b053c7ffbcad9e2be2e7527ed163b571c7651a9000c9674a6c9c16d93b26342f2a1572eb2
SSDEEP

24576:JySTmL6R8NmtyoN25ONpbMTiCr8dEb4UJKW1mZLFeCXDMDYDL7:7TqmJ250W3b4UJKW1mZLFeCXDMDYDL

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://bitrix370.timeweb.ru/
Port:
21
Username:
cn94754
Password:
c2eitfpidhgS

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA your client has an outstanding amount of 60.690€..exe

description pid process target process

PID 3068 set thread context of 1360 3068 SOA your client has an outstanding amount of 60.690€..exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1608 1360 WerFault.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

SOA your client has an outstanding amount of 60.690€..exeMSBuild.exe

pid process

3068 SOA your client has an outstanding amount of 60.690€..exe
1360 MSBuild.exe
1360 MSBuild.exe
1360 MSBuild.exe
1360 MSBuild.exe
1360 MSBuild.exe
1360 MSBuild.exe
1360 MSBuild.exe
1360 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SOA your client has an outstanding amount of 60.690€..exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 3068 SOA your client has an outstanding amount of 60.690€..exe
Token: SeDebugPrivilege 1360 MSBuild.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

description	pid	process	target process
PID 3068 set thread context of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe

pid	pid_target	process	target process
1608	1360	WerFault.exe	MSBuild.exe

pid	process
3068	SOA your client has an outstanding amount of 60.690€..exe
1360	MSBuild.exe
1360	MSBuild.exe
1360	MSBuild.exe
1360	MSBuild.exe
1360	MSBuild.exe
1360	MSBuild.exe
1360	MSBuild.exe
1360	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3068	SOA your client has an outstanding amount of 60.690€..exe
Token: SeDebugPrivilege	1360	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SOA your client has an outstanding amount of 60.690€..exeMSBuild.exe

description	pid	process	target process
PID 3068 wrote to memory of 1128	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1128	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1128	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1128	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 3068 wrote to memory of 1360	3068	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1360 wrote to memory of 1608	1360	MSBuild.exe	WerFault.exe
PID 1360 wrote to memory of 1608	1360	MSBuild.exe	WerFault.exe
PID 1360 wrote to memory of 1608	1360	MSBuild.exe	WerFault.exe
PID 1360 wrote to memory of 1608	1360	MSBuild.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\SOA your client has an outstanding amount of 60.690€..exe
"C:\Users\Admin\AppData\Local\Temp\SOA your client has an outstanding amount of 60.690€..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:1128

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 1072
3⤵
- Program crash
PID:1608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-17-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/1360-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1360-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1360-12-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1360-19-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/1360-14-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1360-9-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1360-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1360-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1360-20-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/1360-10-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3068-2-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-0-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/3068-1-0x0000000000130000-0x0000000000330000-memory.dmp

Filesize
2.0MB

Download
memory/3068-6-0x00000000052B0000-0x0000000005342000-memory.dmp

Filesize
584KB

Download
memory/3068-5-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-18-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-4-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/3068-3-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download