snakekeylogger | 485fcb629691d08260b4066b1261fefbbdd4dd399fb5ebf9df7311c5e0710f68

General

Target

162a7cc38d23c7375e5d5d9c28051c43.exe
Size

1.5MB
MD5

162a7cc38d23c7375e5d5d9c28051c43
SHA1

981534f63e2f386cbc0c8f6f06c85652748c2185
SHA256

485fcb629691d08260b4066b1261fefbbdd4dd399fb5ebf9df7311c5e0710f68
SHA512

2ade29cd1b5b63896431205b33d38bbfc63441ee1b0e6cf992e9189a62c308ebd5b343606f68859c1a092ddb33ccbe99f1a8f6a1589d69f5a1c1f0b0a56f773c

Score

10^/10

snakekeylogger keylogger persistence stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1596-28-0x000000000046381E-mapping.dmp	family_snakekeylogger
behavioral2/memory/1596-32-0x0000000000190000-0x00000000001F8000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

Processes:

scis.exeInstallUtil.exe

pid process

476 scis.exe
1596 InstallUtil.exe

pid	process
476	scis.exe
1596	InstallUtil.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\not = "C:\\Users\\Admin\\scis.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

scis.exe

description pid process target process

PID 476 set thread context of 1596 476 scis.exe InstallUtil.exe

description	pid	process	target process
PID 476 set thread context of 1596	476	scis.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

162a7cc38d23c7375e5d5d9c28051c43.exescis.exeInstallUtil.exe

pid	process
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
4776	162a7cc38d23c7375e5d5d9c28051c43.exe
476	scis.exe
476	scis.exe
1596	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

162a7cc38d23c7375e5d5d9c28051c43.exescis.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4776	162a7cc38d23c7375e5d5d9c28051c43.exe
Token: SeDebugPrivilege	476	scis.exe
Token: SeDebugPrivilege	1596	InstallUtil.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

162a7cc38d23c7375e5d5d9c28051c43.execmd.exescis.exe

description	pid	process	target process
PID 4776 wrote to memory of 2012	4776	162a7cc38d23c7375e5d5d9c28051c43.exe	cmd.exe
PID 4776 wrote to memory of 2012	4776	162a7cc38d23c7375e5d5d9c28051c43.exe	cmd.exe
PID 4776 wrote to memory of 2012	4776	162a7cc38d23c7375e5d5d9c28051c43.exe	cmd.exe
PID 2012 wrote to memory of 508	2012	cmd.exe	reg.exe
PID 2012 wrote to memory of 508	2012	cmd.exe	reg.exe
PID 2012 wrote to memory of 508	2012	cmd.exe	reg.exe
PID 4776 wrote to memory of 476	4776	162a7cc38d23c7375e5d5d9c28051c43.exe	scis.exe
PID 4776 wrote to memory of 476	4776	162a7cc38d23c7375e5d5d9c28051c43.exe	scis.exe
PID 4776 wrote to memory of 476	4776	162a7cc38d23c7375e5d5d9c28051c43.exe	scis.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe
PID 476 wrote to memory of 1596	476	scis.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\162a7cc38d23c7375e5d5d9c28051c43.exe
"C:\Users\Admin\AppData\Local\Temp\162a7cc38d23c7375e5d5d9c28051c43.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "not" /t REG_SZ /d "C:\Users\Admin\scis.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "not" /t REG_SZ /d "C:\Users\Admin\scis.exe"
3⤵
- Adds Run key to start application
PID:508

C:\Users\Admin\scis.exe
"C:\Users\Admin\scis.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\scis.exe
MD5
162a7cc38d23c7375e5d5d9c28051c43

SHA1
981534f63e2f386cbc0c8f6f06c85652748c2185

SHA256
485fcb629691d08260b4066b1261fefbbdd4dd399fb5ebf9df7311c5e0710f68

SHA512
2ade29cd1b5b63896431205b33d38bbfc63441ee1b0e6cf992e9189a62c308ebd5b343606f68859c1a092ddb33ccbe99f1a8f6a1589d69f5a1c1f0b0a56f773c

Download Submit
C:\Users\Admin\scis.exe
MD5
162a7cc38d23c7375e5d5d9c28051c43

SHA1
981534f63e2f386cbc0c8f6f06c85652748c2185

SHA256
485fcb629691d08260b4066b1261fefbbdd4dd399fb5ebf9df7311c5e0710f68

SHA512
2ade29cd1b5b63896431205b33d38bbfc63441ee1b0e6cf992e9189a62c308ebd5b343606f68859c1a092ddb33ccbe99f1a8f6a1589d69f5a1c1f0b0a56f773c

Download Submit
memory/476-26-0x00000000051C1000-0x00000000051C2000-memory.dmp

Filesize
4KB

Download
memory/476-25-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/476-24-0x0000000007A50000-0x0000000007A5B000-memory.dmp

Filesize
44KB

Download
memory/476-23-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/476-16-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/476-13-0x0000000000000000-mapping.dmp

Download
memory/508-11-0x0000000000000000-mapping.dmp

Download
memory/1596-28-0x000000000046381E-mapping.dmp

Download
memory/1596-31-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/1596-32-0x0000000000190000-0x00000000001F8000-memory.dmp

Filesize
416KB

Download
memory/1596-34-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/2012-10-0x0000000000000000-mapping.dmp

Download
memory/4776-12-0x0000000001351000-0x0000000001352000-memory.dmp

Filesize
4KB

Download
memory/4776-9-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Filesize
4KB

Download
memory/4776-8-0x0000000001330000-0x0000000001331000-memory.dmp

Filesize
4KB

Download
memory/4776-7-0x0000000001360000-0x000000000137E000-memory.dmp

Filesize
120KB

Download
memory/4776-6-0x0000000001350000-0x0000000001351000-memory.dmp

Filesize
4KB

Download
memory/4776-2-0x0000000073360000-0x0000000073A4E000-memory.dmp

Filesize
6.9MB

Download
memory/4776-5-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/4776-3-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads