snakekeylogger | f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9

Analysis

max time kernel
121s
max time network
144s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Size

563KB
MD5

8c2f569ddc16f61e8c7b053cbd94f0b4
SHA1

585691bd7c15100b16bc3c49f94a9f9cf9c86477
SHA256

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9
SHA512

ed3a9205c4df6c3531bfa974249face667414a4932862967254a83e0e63bdd7dc95fb79210636f023dd984e15dbc1e65a51226fc1ecfb08f1cbe3d3950d45ee0
SSDEEP

12288:aTOvjSANT3ukfoCJU0/Q0P3H0Nho+EHl00DE64MoQksBl7jMkZQV:aT2jFT3ukNJNPXQAHKeEXMx7Qmm

Score

10^/10

snakekeylogger collection execution keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.speedhouseoman.com
Port:
587
Username:
[email protected]
Password:
SpH@0084

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2960-21-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2960-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2960-22-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2960-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2960-16-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1972 powershell.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1972	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

description	pid	process	target process
PID 2476 set thread context of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2320 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exepowershell.exe

pid process

2960 f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
1972 powershell.exe
2960 f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2960 f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Token: SeDebugPrivilege 1972 powershell.exe

pid	process
2320	schtasks.exe

pid	process
2960	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
1972	powershell.exe
2960	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

description	pid	process
Token: SeDebugPrivilege	2960	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
Token: SeDebugPrivilege	1972	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

description	pid	process	target process
PID 2476 wrote to memory of 1972	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	powershell.exe
PID 2476 wrote to memory of 1972	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	powershell.exe
PID 2476 wrote to memory of 1972	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	powershell.exe
PID 2476 wrote to memory of 1972	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	powershell.exe
PID 2476 wrote to memory of 2320	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	schtasks.exe
PID 2476 wrote to memory of 2320	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	schtasks.exe
PID 2476 wrote to memory of 2320	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	schtasks.exe
PID 2476 wrote to memory of 2320	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	schtasks.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
PID 2476 wrote to memory of 2960	2476	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

outlook_office_path 1 IoCs

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

outlook_win_path 1 IoCs

Processes:

f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe

C:\Users\Admin\AppData\Local\Temp\f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
"C:\Users\Admin\AppData\Local\Temp\f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vgTSRopQheAdCk.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vgTSRopQheAdCk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5DF8.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Users\Admin\AppData\Local\Temp\f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe
"C:\Users\Admin\AppData\Local\Temp\f16af6c4a9c6803eb1df399343edceb8a102c47297c1e9b3278c795f61d5e1e9.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2960

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5DF8.tmp
Filesize
1KB

MD5
6ea4b763c721c6c0a8f3116d98d70cb2

SHA1
8e97752c216e347d758d150b2c44131585c23400

SHA256
26e13295d343f179e3b7f3bf23d201ff7cca03cb6c897560333c40716ac4857c

SHA512
fd16466317a4bf1e31b0fb3c29cb88e15c789108b38ee441bf884b110461efdead48e1f433020e0b430965ffbf2ac9b68b1a738235e6813543140d155294f5f4

Download Submit
memory/2476-24-0x0000000074E90000-0x000000007557E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-1-0x00000000010F0000-0x0000000001182000-memory.dmp

Filesize
584KB

Download
memory/2476-2-0x0000000074E90000-0x000000007557E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-3-0x0000000000470000-0x000000000048A000-memory.dmp

Filesize
104KB

Download
memory/2476-4-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download
memory/2476-5-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/2476-6-0x0000000004E10000-0x0000000004E78000-memory.dmp

Filesize
416KB

Download
memory/2476-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

Filesize
4KB

Download
memory/2960-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2960-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2960-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2960-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2960-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2960-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2960-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2960-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download