snakekeylogger | 6f6a57c57358f12a6a77d4be8639bf52f1486b178182eac9a02b64a85d8f21e2

Analysis

Target

f....exe
Size

765KB
MD5

298fe9f402c7bcb0547cd0125d822c87
SHA1

316d76fc3bb574b33ee52a5558b5f1f508a73f31
SHA256

6f6a57c57358f12a6a77d4be8639bf52f1486b178182eac9a02b64a85d8f21e2
SHA512

5199fc875c677c9b9c415af63011854361c7d4544d07c5b3eb84b4cff24c72a60ae335b81b5135fce16b6160f23d2b6ae0e8cdfe4462d9a44ea18e884217691e

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/860-65-0x0000000000400000-0x0000000000468000-memory.dmp	family_snakekeylogger
behavioral1/memory/860-66-0x0000000000462C2E-mapping.dmp	family_snakekeylogger
behavioral1/memory/860-67-0x0000000000400000-0x0000000000468000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 freegeoip.app
5 checkip.dyndns.org
10 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

f....exe

description pid process target process

PID 1104 set thread context of 860 1104 f....exe f....exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f....exe

pid process

860 f....exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f....exe

description pid process

Token: SeDebugPrivilege 860 f....exe

description	pid	process	target process
PID 1104 set thread context of 860	1104	f....exe	f....exe

pid	process
860	f....exe

description	pid	process
Token: SeDebugPrivilege	860	f....exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f....exe

description	pid	process	target process
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe
PID 1104 wrote to memory of 860	1104	f....exe	f....exe

memory/860-65-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/860-66-0x0000000000462C2E-mapping.dmp

Download
memory/860-67-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/860-69-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/1104-59-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/1104-61-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/1104-62-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/1104-63-0x00000000054E0000-0x0000000005575000-memory.dmp

Filesize
596KB

Download
memory/1104-64-0x0000000005880000-0x000000000592B000-memory.dmp

Filesize
684KB

Download