snakekeylogger | 6693235e62c0d7e14a841185bee306301a9d64fe007ffe9de8798f33fbf81689

General

Target

fopcsUpMj6lv84P.exe
Size

1.1MB
MD5

934e8ac2fdeef16454904dbfdae4f19a
SHA1

4fa2deb2b1ae553845bc5b45ae5640aad464cb21
SHA256

6693235e62c0d7e14a841185bee306301a9d64fe007ffe9de8798f33fbf81689
SHA512

998fd29c4a8e473213d4e78cb921731558773b11e02fe4ef2f2ee373969afcd380d95ffbdb29963c17eb6cea4fa0dcf487ea34b6029ce626dbb8f5c985b0976e

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1652-63-0x0000000000430000-0x000000000043B000-memory.dmp	CustAttr

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

fopcsUpMj6lv84P.exe

description pid process target process

PID 1652 set thread context of 876 1652 fopcsUpMj6lv84P.exe fopcsUpMj6lv84P.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1840 876 WerFault.exe fopcsUpMj6lv84P.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

fopcsUpMj6lv84P.exeWerFault.exe

pid process

876 fopcsUpMj6lv84P.exe
1840 WerFault.exe
1840 WerFault.exe
1840 WerFault.exe
1840 WerFault.exe
1840 WerFault.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fopcsUpMj6lv84P.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 876 fopcsUpMj6lv84P.exe
Token: SeDebugPrivilege 1840 WerFault.exe

flow	ioc
6	checkip.dyndns.org

description	pid	process	target process
PID 1652 set thread context of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe

pid	pid_target	process	target process
1840	876	WerFault.exe	fopcsUpMj6lv84P.exe

description	pid	process
Token: SeDebugPrivilege	876	fopcsUpMj6lv84P.exe
Token: SeDebugPrivilege	1840	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

fopcsUpMj6lv84P.exefopcsUpMj6lv84P.exe

description	pid	process	target process
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 1652 wrote to memory of 876	1652	fopcsUpMj6lv84P.exe	fopcsUpMj6lv84P.exe
PID 876 wrote to memory of 1840	876	fopcsUpMj6lv84P.exe	WerFault.exe
PID 876 wrote to memory of 1840	876	fopcsUpMj6lv84P.exe	WerFault.exe
PID 876 wrote to memory of 1840	876	fopcsUpMj6lv84P.exe	WerFault.exe
PID 876 wrote to memory of 1840	876	fopcsUpMj6lv84P.exe	WerFault.exe

memory/876-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/876-67-0x000000000042002E-mapping.dmp

Download
memory/876-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/876-70-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1652-60-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1652-62-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1652-63-0x0000000000430000-0x000000000043B000-memory.dmp

Filesize
44KB

Download
memory/1652-64-0x0000000004790000-0x00000000047EC000-memory.dmp

Filesize
368KB

Download
memory/1652-65-0x0000000004380000-0x00000000043A2000-memory.dmp

Filesize
136KB

Download
memory/1840-71-0x0000000000000000-mapping.dmp

Download
memory/1840-72-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download