snakekeylogger | 4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf

General

Target

PURCHASE ORDER.exe
Size

576KB
MD5

38f6f05d0bff28a29420efaec6aeab43
SHA1

d9e05a92b6edc27a491fced696eb77a7295510ab
SHA256

4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf
SHA512

f6a4c851d7e496bff2db898c9d5e3c3786f8f68960be963e1cd325ee3429124394e18ecfb4ab4de683ba66bd81618904f801cb591ca335b5755a41a3aaab0769

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4016-13-0x0000000000400000-0x0000000000468000-memory.dmp	family_snakekeylogger
behavioral2/memory/4016-14-0x0000000000463E4E-mapping.dmp	family_snakekeylogger

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral2/memory/3108-7-0x0000000004C80000-0x0000000004D0E000-memory.dmp	beds_protector

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 checkip.dyndns.org
12 freegeoip.app
13 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

PURCHASE ORDER.exe

description pid process target process

PID 3108 set thread context of 4016 3108 PURCHASE ORDER.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

4016 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 4016 RegAsm.exe

flow	ioc
9	checkip.dyndns.org
12	freegeoip.app
13	freegeoip.app

description	pid	process	target process
PID 3108 set thread context of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe

pid	process
4016	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4016	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PURCHASE ORDER.exe

description	pid	process	target process
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe
PID 3108 wrote to memory of 4016	3108	PURCHASE ORDER.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3108-11-0x0000000007170000-0x0000000007171000-memory.dmp

Filesize
4KB

Download
memory/3108-7-0x0000000004C80000-0x0000000004D0E000-memory.dmp

Filesize
568KB

Download
memory/3108-2-0x00000000739A0000-0x000000007408E000-memory.dmp

Filesize
6.9MB

Download
memory/3108-6-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/3108-12-0x00000000070D0000-0x00000000070DF000-memory.dmp

Filesize
60KB

Download
memory/3108-8-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/3108-9-0x0000000004D90000-0x0000000004D91000-memory.dmp

Filesize
4KB

Download
memory/3108-16-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/3108-5-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3108-3-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/3108-10-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/3108-17-0x0000000004D23000-0x0000000004D25000-memory.dmp

Filesize
8KB

Download
memory/4016-15-0x00000000739A0000-0x000000007408E000-memory.dmp

Filesize
6.9MB

Download
memory/4016-14-0x0000000000463E4E-mapping.dmp

Download
memory/4016-13-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/4016-22-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/4016-23-0x0000000006940000-0x0000000006941000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads