Fortinet FortiGuard Labs analyzed a phishing campaign delivering a new Snake Keylogger variant via a malicious Excel document that exploits CVE-2017-0199 and employs multi-stage scripting to download and execute the loader. The campaign persists with scheduled tasks, uses process hollowing to run the payload, and exfiltrates credentials over SMTP, with FortiGuard protections in place.
#SnakeKeylogger #CVE-2017-0199
#SnakeKeylogger #CVE-2017-0199
Keypoints
- Affected Platforms: Microsoft Windows
- Delivery Method: Phishing email delivering a malicious Excel document
- Keylogger Variant: Snake Keylogger (aka 404 Keylogger or KrakenKeylogger)
- Exploited Vulnerability: CVE-2017-0199
- Persistence: Scheduled tasks to ensure startup execution
- Data Exfiltration: Credentials sent to attacker via SMTP
- Fortinet Protections: FortiGuard services protect against this campaign
MITRE Techniques
- [T1566] Phishing – Uses phishing emails to deliver malicious Excel documents. “The email content in Figure 1 attempts to deceive the recipient into opening the attached Excel file (swift copy.xls) by claiming that funds have been transferred into their account.”
- [T1203] Exploitation for Client Execution – Exploits CVE-2017-0199 to download a malicious file. “The link is “hxxp[:]//192.3.176[.]138/xampp/zoom/107.hta”.
- [T1027] Obfuscated/Compressed Files and Information – Core modules are obfuscated/encrypted within resources. “the attacker has fully obfuscated the entire module, which displays its entry point (‘Main()’) and the obfuscated code.”
- [T1059] Command and Scripting Interpreter – Uses VBScript to run PowerShell code decoded from a base64 string and executed via cmd.exe. “PowerShell code is then executed by ‘cmd.exe’ (%ComSpec%) when the ‘shellObj.Run()’ function is called.”
- [T1053] Scheduled Task – Creates a scheduled task to persist at startup. “The Deploy module runs the ‘schetasks.exe’ command to create a new scheduled task in the system Task Scheduler.”
- [T1093] Process Hollowing – Uses process hollowing to run the core module inside a suspended process. “The Deploy module performs process hollowing… to run.”
- [T1041] Data Exfiltration – Sends collected credentials to the attacker via SMTP. “sends data to the attacker via SMTP.”
Indicators of Compromise
- [URL] – hxxp://urlty[.]co/byPCO, hxxp[:]//192.3.176[.]138/xampp/zoom/107.hta, and hxxp[:]//192.3.176[.]138/107/sahost.exe
- [IP Address] – 192.3.176.138 (host for 107.hta and sahost.exe delivery)
- [SHA-256] – swift copy.xls: 8406A1D7A33B3549DD44F551E5A68392F85B5EF9CF8F9F3DB68BD7E02D1EABA7
- [SHA-256] – 107.hta: 6F6A660CE89F6EA5BBE532921DDC4AA17BCD3F2524AA2461D4BE265C9E7328B9
- [SHA-256] – sahost.exe / WeENKtk.exe / utGw.exe: 484E5A871AD69D6B214A31A3B7F8CFCED71BA7A07E62205A90515F350CC0F723
- [SHA-256] – Loader core module: 207DD751868995754F8C1223C08F28633B47629F78FAAF70A3B931459EE60714