snakekeylogger | 4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf

General

Target

PURCHASE ORDER.exe
Size

576KB
MD5

38f6f05d0bff28a29420efaec6aeab43
SHA1

d9e05a92b6edc27a491fced696eb77a7295510ab
SHA256

4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf
SHA512

f6a4c851d7e496bff2db898c9d5e3c3786f8f68960be963e1cd325ee3429124394e18ecfb4ab4de683ba66bd81618904f801cb591ca335b5755a41a3aaab0769

Score

10^/10

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1184-9-0x0000000000463E4E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1184-8-0x0000000000400000-0x0000000000468000-memory.dmp	family_snakekeylogger
behavioral1/memory/1184-13-0x0000000000400000-0x0000000000468000-memory.dmp	family_snakekeylogger

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1728-5-0x0000000000AA0000-0x0000000000B2E000-memory.dmp	beds_protector

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 freegeoip.app
12 freegeoip.app
6 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PURCHASE ORDER.exe

description pid process target process

PID 1728 set thread context of 1184 1728 PURCHASE ORDER.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

1184 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1184 RegAsm.exe

description	pid	process	target process
PID 1728 set thread context of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe

pid	process
1184	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1184	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PURCHASE ORDER.exe

description	pid	process	target process
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe
PID 1728 wrote to memory of 1184	1728	PURCHASE ORDER.exe	RegAsm.exe

memory/1184-9-0x0000000000463E4E-mapping.dmp

Download
memory/1184-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1184-11-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1184-12-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/1184-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1184-15-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/1728-2-0x0000000074120000-0x000000007480E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-3-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/1728-5-0x0000000000AA0000-0x0000000000B2E000-memory.dmp

Filesize
568KB

Download
memory/1728-6-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/1728-7-0x0000000000A10000-0x0000000000A1F000-memory.dmp

Filesize
60KB

Download
memory/1728-10-0x0000000004A55000-0x0000000004A66000-memory.dmp

Filesize
68KB

Download