snakekeylogger | 2b2b2d652f0df53f1bdf4eead3ef92831132eacfef595043033d375dfe91c8ef

General

Target

4ff2f77e4d4cf8207749dd70205c6551.exe
Size

565KB
MD5

4ff2f77e4d4cf8207749dd70205c6551
SHA1

4f28db25dc9b18f918d9fa74ae85b549a4128e29
SHA256

2b2b2d652f0df53f1bdf4eead3ef92831132eacfef595043033d375dfe91c8ef
SHA512

31b19d87be54214de05cf27ffddbbc6f3f233b86bc5057517da1d11419fb8ecd3bd5b9930171dbbb8984792382915c089a38a34a66538940cde662ee8684335c

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

4ff2f77e4d4cf8207749dd70205c6551.exe

description pid process target process

PID 632 set thread context of 3832 632 4ff2f77e4d4cf8207749dd70205c6551.exe 4ff2f77e4d4cf8207749dd70205c6551.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

4ff2f77e4d4cf8207749dd70205c6551.exedw20.exe

pid process

3832 4ff2f77e4d4cf8207749dd70205c6551.exe
1020 dw20.exe
1020 dw20.exe

flow	ioc
14	checkip.dyndns.org

description	pid	process	target process
PID 632 set thread context of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

4ff2f77e4d4cf8207749dd70205c6551.exedw20.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

4ff2f77e4d4cf8207749dd70205c6551.exe4ff2f77e4d4cf8207749dd70205c6551.exe

description	pid	process	target process
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 632 wrote to memory of 3832	632	4ff2f77e4d4cf8207749dd70205c6551.exe	4ff2f77e4d4cf8207749dd70205c6551.exe
PID 3832 wrote to memory of 1020	3832	4ff2f77e4d4cf8207749dd70205c6551.exe	dw20.exe
PID 3832 wrote to memory of 1020	3832	4ff2f77e4d4cf8207749dd70205c6551.exe	dw20.exe
PID 3832 wrote to memory of 1020	3832	4ff2f77e4d4cf8207749dd70205c6551.exe	dw20.exe

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\4ff2f77e4d4cf8207749dd70205c6551.exe.log
MD5
ef140ef600b2463c9e7dbf064a104046

SHA1
c08fd1853877be95575ea2e860dd8cafef31f54c

SHA256
ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

SHA512
bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

Download Submit
memory/632-114-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Filesize
4KB

Download
memory/1020-119-0x0000000000000000-mapping.dmp

Download
memory/3832-115-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3832-116-0x000000000044320E-mapping.dmp

Download
memory/3832-118-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download