snakekeylogger | c5b9529a719d2acc7c9e2fad96ef6b960d0c7a90ddfd14767c2baa6a93939527

Analysis

max time kernel
133s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
Size

130KB
MD5

ae65828171d12dbd2817503f7c230d22
SHA1

3822837f216fca0e57ad17c799965492efc1f336
SHA256

c5b9529a719d2acc7c9e2fad96ef6b960d0c7a90ddfd14767c2baa6a93939527
SHA512

2ff7aa799b4ee56266b1e67f472052666c211e229854fd6afd67a217403177b789b766736c18d8ba57fcdfdca6a2687db1e67adeb0994247c773fcb453d0f39b
SSDEEP

3072:TysXix6vlYO39/L08MExkYMxvxlojbaGeplsLJwvxpBogbY:dix6dYO3RgxojbnepxBxb

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
valleycountysar.org
Port:
26
Username:
[email protected]
Password:
fY,FLoadtsiF

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Snake Keylogger payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4912-1-0x0000000000610000-0x0000000000636000-memory.dmp family_snakekeylogger
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

resource	yara_rule
behavioral2/memory/4912-1-0x0000000000610000-0x0000000000636000-memory.dmp	family_snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 checkip.dyndns.org
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

pid process

4912 f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
4912 f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

description pid process

Token: SeDebugPrivilege 4912 f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

flow	ioc
7	checkip.dyndns.org

pid	process
4912	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
4912	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

description	pid	process
Token: SeDebugPrivilege	4912	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

outlook_office_path 1 IoCs

Processes:

f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

outlook_win_path 1 IoCs

Processes:

f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe

C:\Users\Admin\AppData\Local\Temp\f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe
"C:\Users\Admin\AppData\Local\Temp\f3c462280fd1964d68c76ff6889bd3c766fa7140c07962dda32c0cb488188695_payload.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1416,i,17949988676391029604,13756926835471203788,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:3604

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4912-0-0x000000007523E000-0x000000007523F000-memory.dmp

Filesize
4KB

Download
memory/4912-1-0x0000000000610000-0x0000000000636000-memory.dmp

Filesize
152KB

Download
memory/4912-2-0x0000000005730000-0x0000000005CD4000-memory.dmp

Filesize
5.6MB

Download
memory/4912-3-0x00000000050A0000-0x000000000513C000-memory.dmp

Filesize
624KB

Download
memory/4912-4-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/4912-5-0x00000000064F0000-0x0000000006540000-memory.dmp

Filesize
320KB

Download
memory/4912-6-0x0000000006710000-0x00000000068D2000-memory.dmp

Filesize
1.8MB

Download
memory/4912-7-0x00000000065E0000-0x0000000006672000-memory.dmp

Filesize
584KB

Download
memory/4912-8-0x0000000006540000-0x000000000654A000-memory.dmp

Filesize
40KB

Download
memory/4912-9-0x000000007523E000-0x000000007523F000-memory.dmp

Filesize
4KB

Download
memory/4912-10-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download