snakekeylogger | 1cb8fe9e0457c4b0f986f45462b5c35c595374f045a52f0e19a40a9bd8b79195

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA your client has an outstanding amount of 60.690€..exe
Size

2.0MB
MD5

92c83a8f67d64aef2b94f1b79ad2f538
SHA1

a169688d6044aec9d97407f4350316d238cf17e0
SHA256

9cb0c51bde1990ee8ac844aba1a8c1f18cc22e8a573f3363214afff4c3959f5f
SHA512

3529dbd000605b6553c22e8c4b2f22aedbb82893786d07a0a41e5f2b053c7ffbcad9e2be2e7527ed163b571c7651a9000c9674a6c9c16d93b26342f2a1572eb2
SSDEEP

24576:JySTmL6R8NmtyoN25ONpbMTiCr8dEb4UJKW1mZLFeCXDMDYDL7:7TqmJ250W3b4UJKW1mZLFeCXDMDYDL

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: ftp
Host:
ftp://bitrix370.timeweb.ru/
Port:
21
Username:
cn94754
Password:
c2eitfpidhgS

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

62 checkip.dyndns.org
64 freegeoip.app
65 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA your client has an outstanding amount of 60.690€..exe

description pid process target process

PID 1832 set thread context of 2020 1832 SOA your client has an outstanding amount of 60.690€..exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1904 2020 WerFault.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

MSBuild.exe

pid process

2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
2020 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2020 MSBuild.exe

flow	ioc
62	checkip.dyndns.org
64	freegeoip.app
65	freegeoip.app

description	pid	process	target process
PID 1832 set thread context of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe

pid	pid_target	process	target process
1904	2020	WerFault.exe	MSBuild.exe

pid	process
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe
2020	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2020	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SOA your client has an outstanding amount of 60.690€..exe

description	pid	process	target process
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe
PID 1832 wrote to memory of 2020	1832	SOA your client has an outstanding amount of 60.690€..exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\SOA your client has an outstanding amount of 60.690€..exe
"C:\Users\Admin\AppData\Local\Temp\SOA your client has an outstanding amount of 60.690€..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1444
3⤵
- Program crash
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4648,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
1⤵
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2020 -ip 2020
1⤵
PID:2600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-8-0x0000000005430000-0x000000000543A000-memory.dmp

Filesize
40KB

Download
memory/1832-2-0x0000000004F50000-0x0000000004FEC000-memory.dmp

Filesize
624KB

Download
memory/1832-9-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/1832-10-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-4-0x0000000005090000-0x0000000005122000-memory.dmp

Filesize
584KB

Download
memory/1832-5-0x0000000005000000-0x000000000500A000-memory.dmp

Filesize
40KB

Download
memory/1832-6-0x0000000005240000-0x0000000005296000-memory.dmp

Filesize
344KB

Download
memory/1832-7-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/1832-0-0x00000000745FE000-0x00000000745FF000-memory.dmp

Filesize
4KB

Download
memory/1832-1-0x0000000000350000-0x0000000000550000-memory.dmp

Filesize
2.0MB

Download
memory/1832-3-0x00000000055A0000-0x0000000005B44000-memory.dmp

Filesize
5.6MB

Download
memory/1832-11-0x0000000000F10000-0x0000000000FA2000-memory.dmp

Filesize
584KB

Download
memory/1832-15-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2020-12-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2020-14-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2020-16-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/2020-17-0x0000000006B60000-0x0000000006D22000-memory.dmp

Filesize
1.8MB

Download
memory/2020-18-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download