snakekeylogger | 397380c85090e20674183bd7011fc2815c1c77ab81c8d47b7608b68b3662cb90

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO1.exe
Size

2.4MB
MD5

66c621421dca0a83dd1fa02671f75fda
SHA1

b5e0c952e9aba5e53110d6b2fbce2da26dcb6f97
SHA256

bc38233e18628256407420a857d1a1999974331cac7c5beb4368550d1d15f91d
SHA512

244e38a114960574484f1b8e0c2b96d01cbea67b2d67c730fa4563992c7616692f86e89f27886dac5a5ffc1806f429185e0dc232331b67df94ca9d668cbcd7b2
SSDEEP

12288:semYZS+7EaoDKSKMFyeXJ4AVkchfmS9eVINxsvbp9:Pa+oao/KMFy6iKdeVI2X

Score

10^/10

snakekeylogger collection keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2808-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2808-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO1.exe

description pid process target process

PID 2232 set thread context of 2808 2232 PO1.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

2808 AddInProcess32.exe
2808 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AddInProcess32.exe

description pid process

Token: SeDebugPrivilege 2808 AddInProcess32.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 2232 set thread context of 2808	2232	PO1.exe	AddInProcess32.exe

pid	process
2808	AddInProcess32.exe
2808	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2808	AddInProcess32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PO1.exe

description	pid	process	target process
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2808	2232	PO1.exe	AddInProcess32.exe
PID 2232 wrote to memory of 2636	2232	PO1.exe	WerFault.exe
PID 2232 wrote to memory of 2636	2232	PO1.exe	WerFault.exe
PID 2232 wrote to memory of 2636	2232	PO1.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

Processes:

AddInProcess32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\PO1.exe
"C:\Users\Admin\AppData\Local\Temp\PO1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2232 -s 620
2⤵
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-0-0x000007FEF5A33000-0x000007FEF5A34000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x00000000010A0000-0x00000000010A8000-memory.dmp

Filesize
32KB

Download
memory/2232-2-0x0000000000D50000-0x0000000000DCA000-memory.dmp

Filesize
488KB

Download
memory/2232-3-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-24-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-21-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-20-0x000007FEF5A33000-0x000007FEF5A34000-memory.dmp

Filesize
4KB

Download
memory/2808-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2808-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-18-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2808-19-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2808-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2808-22-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2808-23-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2808-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download