snakekeylogger | 96b12d371375868fc87d73454805ea2db22f27d46424808c9c3a2cd8fba03296

General

Target

Ecol Sp RFQ.122113.exe
Size

836KB
MD5

9a2225e1b9acd802016c1d880528de49
SHA1

0e9b0abd02fd0c321ddbd6b3140c7c3cf0fa1d9d
SHA256

38b556205aa56d97e3e6e2702bd4822b489403e3903132493893e5aced988b83
SHA512

424029d7bcd9276a7b1c920f80feda282a53f61f75bc665c5b388c5cc8b2a148489bbf1ef67dedd635c3999284145899d725188b54cff792edfbf173859395ae

Score

10^/10

Family

snakekeylogger

C2

https://api.telegram.org/bot1841252439:AAFeBNk12wAgfxXFXtqpw50JT4iCgTc-FsM/sendMessage?chat_id=-487183096

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 freegeoip.app
19 freegeoip.app
15 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ecol Sp RFQ.122113.exe

description pid process target process

PID 1840 set thread context of 2792 1840 Ecol Sp RFQ.122113.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Ecol Sp RFQ.122113.exeMSBuild.exe

pid process

1840 Ecol Sp RFQ.122113.exe
1840 Ecol Sp RFQ.122113.exe
2792 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Ecol Sp RFQ.122113.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1840 Ecol Sp RFQ.122113.exe
Token: SeDebugPrivilege 2792 MSBuild.exe

description	pid	process	target process
PID 1840 set thread context of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1840	Ecol Sp RFQ.122113.exe
Token: SeDebugPrivilege	2792	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Ecol Sp RFQ.122113.exe

description	pid	process	target process
PID 1840 wrote to memory of 3364	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 3364	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 3364	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe
PID 1840 wrote to memory of 2792	1840	Ecol Sp RFQ.122113.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:3364

memory/1840-114-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1840-116-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/1840-117-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/1840-118-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/1840-119-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/1840-120-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/1840-121-0x0000000004E10000-0x000000000530E000-memory.dmp

Filesize
5.0MB

Download
memory/1840-122-0x0000000004DE0000-0x0000000004DFE000-memory.dmp

Filesize
120KB

Download
memory/1840-123-0x0000000005270000-0x00000000052E7000-memory.dmp

Filesize
476KB

Download
memory/1840-124-0x0000000007EE0000-0x0000000007F18000-memory.dmp

Filesize
224KB

Download
memory/2792-125-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2792-126-0x000000000041F83E-mapping.dmp

Download
memory/2792-131-0x0000000005430000-0x000000000592E000-memory.dmp

Filesize
5.0MB

Download
memory/2792-132-0x0000000006400000-0x0000000006401000-memory.dmp

Filesize
4KB

Download