snakekeylogger | 9007e48e96d61bd39071800d148a9c9817ece0ef5ec22e71ddef419b179d352a

Analysis

max time kernel
121s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
Size

826KB
MD5

68bcd11da168bcd33c61adfe6cf8b2b3
SHA1

2c1233fb5a6e73a8cf5b97248f771ca92f3776dc
SHA256

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0
SHA512

9fdb2a0615a85354c6f1588e5ee2d8685b0d6f1e1d0913440090df9d704f87a84f5131fd978a0acfad2e46380b3b925907c57745b57b7466d6ee38c39b59b563
SSDEEP

12288:B61ODNf+wYk4ezUlsvU6PnfdLEoB+q0yJsIYScFpy7w88Uk8/6Tk976QCAxGXgXM:X4ezUqTRGpIYSupf8v/6Tkl6EGQgxN7

Score

10^/10

snakekeylogger collection execution keylogger spyware stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.therealdealboattours.com
Port:
587
Username:
[email protected]
Password:
success$2022

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2548-30-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2548-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2548-28-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2548-29-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2548-25-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2532 powershell.exe
2856 powershell.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2532	powershell.exe
2856	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

description	pid	process	target process
PID 2188 set thread context of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2844 schtasks.exe

pid	process
2844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exepowershell.exepowershell.exe

pid	process
2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
2548	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
2856	powershell.exe
2532	powershell.exe
2548	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
Token: SeDebugPrivilege	2548	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

description	pid	process	target process
PID 2188 wrote to memory of 2532	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2532	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2532	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2532	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2856	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2856	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2856	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2856	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	powershell.exe
PID 2188 wrote to memory of 2844	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	schtasks.exe
PID 2188 wrote to memory of 2844	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	schtasks.exe
PID 2188 wrote to memory of 2844	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	schtasks.exe
PID 2188 wrote to memory of 2844	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	schtasks.exe
PID 2188 wrote to memory of 2500	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2500	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2500	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2500	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
PID 2188 wrote to memory of 2548	2188	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

outlook_office_path 1 IoCs

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

outlook_win_path 1 IoCs

Processes:

4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe

C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
"C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lmUupyodsah.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lmUupyodsah" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B59.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
"C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe"
2⤵
PID:2500

C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe
"C:\Users\Admin\AppData\Local\Temp\4c38813ca8fc7a8a94acab611b0d5a8f64592e6c8e5df52e35b7182cdec8dab0.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2548

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5B59.tmp
Filesize
1KB

MD5
8d33fc55d0cc03b20188002641fd06f9

SHA1
2bc59ee4adf8610a796165d78fed08073f6b9f14

SHA256
7ee2901471e23c2316cf475e5c0fd704c3f21ec78ebecf3fb92b957dcb523ade

SHA512
d7779687036942a37a5414d422b3abce7f5b797d3e7b8d18171a25d0a455861b281fba5471ecf42666392137651f70299373b74800ecc966c78bc47f1689dbe4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z0221H9DRCUNORJT1LKJ.temp
Filesize
7KB

MD5
a852b0ea40f93951a9b097014e67005b

SHA1
abea5794356c0141329b659320a61bb8e34a1b57

SHA256
7f46ae2d120d61dbe5bacc6c442a4fc5af60c3c54cc3000b14f33dfb60d04703

SHA512
1df90cae21ebf99eddd257594d28d2b28e908e8a3c9594fd4694a352819258079f1afae037b0669ed41eedd35a3387073eee24dcf305ae7041d20ea937ff1655

Download Submit
memory/2188-4-0x00000000003A0000-0x00000000003A8000-memory.dmp

Filesize
32KB

Download
memory/2188-31-0x0000000074D00000-0x00000000753EE000-memory.dmp

Filesize
6.9MB

Download
memory/2188-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/2188-5-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/2188-6-0x0000000004E30000-0x0000000004ED6000-memory.dmp

Filesize
664KB

Download
memory/2188-2-0x0000000074D00000-0x00000000753EE000-memory.dmp

Filesize
6.9MB

Download
memory/2188-1-0x00000000008D0000-0x00000000009A6000-memory.dmp

Filesize
856KB

Download
memory/2188-3-0x00000000003E0000-0x00000000003FA000-memory.dmp

Filesize
104KB

Download
memory/2548-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2548-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2548-30-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2548-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2548-28-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2548-29-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2548-25-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2548-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download