snakekeylogger | 9c247a73a2b93a70b14c37b1dbf564f38db8bb9a0e7160de1971655a4e02950a

Analysis

Target

fatura.exe
Size

1.1MB
MD5

6a9d0ec45e52137abf05b546151dc664
SHA1

2ea215c3bac1316746fb0ddb9ad7be216a596220
SHA256

9c247a73a2b93a70b14c37b1dbf564f38db8bb9a0e7160de1971655a4e02950a
SHA512

4b0a78c6da7c010c81d36d1e9ae70b60059e1e19b589221329bb447d798db0b36015e07fe7c282fc0250b409845376dd8e1651725cd8783883084d9891de994e

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

fatura.exe

description pid process target process

PID 1832 set thread context of 1548 1832 fatura.exe fatura.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fatura.exe

pid process

1548 fatura.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fatura.exe

description pid process

Token: SeDebugPrivilege 1548 fatura.exe

flow	ioc
6	checkip.dyndns.org

description	pid	process	target process
PID 1832 set thread context of 1548	1832	fatura.exe	fatura.exe

pid	process
1548	fatura.exe

description	pid	process
Token: SeDebugPrivilege	1548	fatura.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fatura.exefatura.exe

description	pid	process	target process
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1832 wrote to memory of 1548	1832	fatura.exe	fatura.exe
PID 1548 wrote to memory of 108	1548	fatura.exe	dw20.exe
PID 1548 wrote to memory of 108	1548	fatura.exe	dw20.exe
PID 1548 wrote to memory of 108	1548	fatura.exe	dw20.exe
PID 1548 wrote to memory of 108	1548	fatura.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 960
3⤵
PID:108

memory/108-66-0x0000000000000000-mapping.dmp

Download
memory/108-68-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/1548-62-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1548-63-0x000000000044285E-mapping.dmp

Download
memory/1548-65-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1832-59-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/1832-60-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/1832-61-0x0000000000AC1000-0x0000000000AC2000-memory.dmp

Filesize
4KB

Download