snakekeylogger | d86b3acfe2d1e7d16c024f51e56bcba13b05390cea05f6b31e146d172bb2b082

General

Target

INV_098789.exe
Size

474KB
MD5

add006df937fd85501cc5722e9e23dc8
SHA1

49064657d66f66292daf07564f471c23b33bf3e7
SHA256

d86b3acfe2d1e7d16c024f51e56bcba13b05390cea05f6b31e146d172bb2b082
SHA512

130a06a4475840aa7ddebbf6129f62079d44e95714f41d0e5e2335053737ce943c8b710b179f551a99e4fc0189c0bdc2e0c29a0aa6662ca6777751e2f17f91f0

Score

10^/10

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1192-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/1192-8-0x000000000046412E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1192-11-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 freegeoip.app
6 checkip.dyndns.org
15 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

INV_098789.exe

description pid process target process

PID 1632 set thread context of 1192 1632 INV_098789.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1460 1632 WerFault.exe INV_098789.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

RegAsm.exeWerFault.exe

pid process

1192 RegAsm.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
1460 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegAsm.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1192 RegAsm.exe
Token: SeDebugPrivilege 1460 WerFault.exe

description	pid	process	target process
PID 1632 set thread context of 1192	1632	INV_098789.exe	RegAsm.exe

pid	pid_target	process	target process
1460	1632	WerFault.exe	INV_098789.exe

description	pid	process
Token: SeDebugPrivilege	1192	RegAsm.exe
Token: SeDebugPrivilege	1460	WerFault.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

INV_098789.exe

description	pid	process	target process
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1192	1632	INV_098789.exe	RegAsm.exe
PID 1632 wrote to memory of 1460	1632	INV_098789.exe	WerFault.exe
PID 1632 wrote to memory of 1460	1632	INV_098789.exe	WerFault.exe
PID 1632 wrote to memory of 1460	1632	INV_098789.exe	WerFault.exe
PID 1632 wrote to memory of 1460	1632	INV_098789.exe	WerFault.exe

memory/1192-14-0x0000000004630000-0x0000000004631000-memory.dmp

Filesize
4KB

Download
memory/1192-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1192-8-0x000000000046412E-mapping.dmp

Download
memory/1192-9-0x0000000076341000-0x0000000076343000-memory.dmp

Filesize
8KB

Download
memory/1192-10-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/1192-11-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1460-18-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1460-17-0x0000000001EE0000-0x0000000001EF1000-memory.dmp

Filesize
68KB

Download
memory/1460-16-0x0000000000000000-mapping.dmp

Download
memory/1632-6-0x0000000000540000-0x000000000054F000-memory.dmp

Filesize
60KB

Download
memory/1632-13-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download
memory/1632-15-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1632-2-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/1632-5-0x0000000000900000-0x0000000000975000-memory.dmp

Filesize
468KB

Download
memory/1632-3-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download