snakekeylogger | 56556e830447f0c2c6093cf975f23d275ad7fa9b88d468550a23ccd24b431a45

General

Target

764abd8daf6dddba262e3bbae25fdbf5.exe
Size

219KB
MD5

764abd8daf6dddba262e3bbae25fdbf5
SHA1

50e8ce314166970d06120941a85f1ecb4d29a53d
SHA256

56556e830447f0c2c6093cf975f23d275ad7fa9b88d468550a23ccd24b431a45
SHA512

e09fd9702857f4a76a0e527ec619cc0a26f603b4e56fb19fdb88b77996f97735fb4886e1c099804b141ce8279df3d132ed8ba1c92946ca0928966e9f140eed0d

Score

10^/10

snakekeylogger keylogger persistence stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
nobetone.xyz
Port:
587
Username:
[email protected]
Password:
J!sLkWAZ3yA9

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-65-0x000000000046477E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1736-64-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/1736-66-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

764abd8daf6dddba262e3bbae25fdbf5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\note = "\"C:\\Users\\Admin\\AppData\\Local\\note.exe\""	764abd8daf6dddba262e3bbae25fdbf5.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 checkip.dyndns.org
16 freegeoip.app
17 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

764abd8daf6dddba262e3bbae25fdbf5.exe

description pid process target process

PID 368 set thread context of 1736 368 764abd8daf6dddba262e3bbae25fdbf5.exe 764abd8daf6dddba262e3bbae25fdbf5.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

764abd8daf6dddba262e3bbae25fdbf5.exe764abd8daf6dddba262e3bbae25fdbf5.exe

pid process

368 764abd8daf6dddba262e3bbae25fdbf5.exe
368 764abd8daf6dddba262e3bbae25fdbf5.exe
1736 764abd8daf6dddba262e3bbae25fdbf5.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

764abd8daf6dddba262e3bbae25fdbf5.exe764abd8daf6dddba262e3bbae25fdbf5.exe

description pid process

Token: SeDebugPrivilege 368 764abd8daf6dddba262e3bbae25fdbf5.exe
Token: SeDebugPrivilege 1736 764abd8daf6dddba262e3bbae25fdbf5.exe

flow	ioc
11	checkip.dyndns.org
16	freegeoip.app
17	freegeoip.app

description	pid	process	target process
PID 368 set thread context of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe

pid	process
368	764abd8daf6dddba262e3bbae25fdbf5.exe
368	764abd8daf6dddba262e3bbae25fdbf5.exe
1736	764abd8daf6dddba262e3bbae25fdbf5.exe

description	pid	process
Token: SeDebugPrivilege	368	764abd8daf6dddba262e3bbae25fdbf5.exe
Token: SeDebugPrivilege	1736	764abd8daf6dddba262e3bbae25fdbf5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

764abd8daf6dddba262e3bbae25fdbf5.exe

description	pid	process	target process
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe
PID 368 wrote to memory of 1736	368	764abd8daf6dddba262e3bbae25fdbf5.exe	764abd8daf6dddba262e3bbae25fdbf5.exe

C:\Users\Admin\AppData\Local\Temp\764abd8daf6dddba262e3bbae25fdbf5.exe
"C:\Users\Admin\AppData\Local\Temp\764abd8daf6dddba262e3bbae25fdbf5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\764abd8daf6dddba262e3bbae25fdbf5.exe
  C:\Users\Admin\AppData\Local\Temp\764abd8daf6dddba262e3bbae25fdbf5.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-59-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/368-61-0x00000000003A0000-0x00000000003A2000-memory.dmp

Filesize
8KB

Download
memory/368-62-0x00000000048E0000-0x00000000048E1000-memory.dmp

Filesize
4KB

Download
memory/368-63-0x00000000006D0000-0x0000000000705000-memory.dmp

Filesize
212KB

Download
memory/1736-65-0x000000000046477E-mapping.dmp

Download
memory/1736-64-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1736-66-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1736-68-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads