snakekeylogger | 1a2eb9acfe8bb06d2b0e8e5124bbc123d4aeffacc0d129c7d9a2c36be3786b76

General

Target

040c97d88d85a6125f0d00bc5173f94a.exe
Size

600KB
MD5

040c97d88d85a6125f0d00bc5173f94a
SHA1

7d6f268c252f97a004f2b123aed5b8bafbf43350
SHA256

1a2eb9acfe8bb06d2b0e8e5124bbc123d4aeffacc0d129c7d9a2c36be3786b76
SHA512

5401f2e0e88db389746012d5f1041540b5f6ba1f64c09e8d945a1a41100de459c73c7a401a4ef982403a5613dd9d72ca9a4dd1cd6004fa7eb264791c2a47f0b7

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.sapphireclothing.com
Port:
587
Username:
hr@sapphireclothing.com
Password:
hrSap2018

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

040c97d88d85a6125f0d00bc5173f94a.exe

description pid process target process

PID 2696 set thread context of 3416 2696 040c97d88d85a6125f0d00bc5173f94a.exe 040c97d88d85a6125f0d00bc5173f94a.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1620 3416 WerFault.exe 040c97d88d85a6125f0d00bc5173f94a.exe

flow	ioc
22	checkip.dyndns.org

description	pid	process	target process
PID 2696 set thread context of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe

pid	pid_target	process	target process
1620	3416	WerFault.exe	040c97d88d85a6125f0d00bc5173f94a.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

040c97d88d85a6125f0d00bc5173f94a.exe040c97d88d85a6125f0d00bc5173f94a.exeWerFault.exe

pid	process
2696	040c97d88d85a6125f0d00bc5173f94a.exe
2696	040c97d88d85a6125f0d00bc5173f94a.exe
3416	040c97d88d85a6125f0d00bc5173f94a.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe
1620	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

040c97d88d85a6125f0d00bc5173f94a.exe040c97d88d85a6125f0d00bc5173f94a.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2696	040c97d88d85a6125f0d00bc5173f94a.exe
Token: SeDebugPrivilege	3416	040c97d88d85a6125f0d00bc5173f94a.exe
Token: SeRestorePrivilege	1620	WerFault.exe
Token: SeBackupPrivilege	1620	WerFault.exe
Token: SeDebugPrivilege	1620	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

040c97d88d85a6125f0d00bc5173f94a.exe

description	pid	process	target process
PID 2696 wrote to memory of 3964	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3964	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3964	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe
PID 2696 wrote to memory of 3416	2696	040c97d88d85a6125f0d00bc5173f94a.exe	040c97d88d85a6125f0d00bc5173f94a.exe

C:\Users\Admin\AppData\Local\Temp\040c97d88d85a6125f0d00bc5173f94a.exe
"C:\Users\Admin\AppData\Local\Temp\040c97d88d85a6125f0d00bc5173f94a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696

C:\Users\Admin\AppData\Local\Temp\040c97d88d85a6125f0d00bc5173f94a.exe
"C:\Users\Admin\AppData\Local\Temp\040c97d88d85a6125f0d00bc5173f94a.exe"
2⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\040c97d88d85a6125f0d00bc5173f94a.exe
"C:\Users\Admin\AppData\Local\Temp\040c97d88d85a6125f0d00bc5173f94a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1500
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\040c97d88d85a6125f0d00bc5173f94a.exe.log
MD5
f1181bc4bdff57024c4121f645548332

SHA1
d431ee3a3a5afcae2c4537b1d445054a0a95f6e6

SHA256
f1a7e138b25d0cb24bb4b23bd781b0dd357afd49d45e19ffa44cdb80170336ad

SHA512
cf8059f289bcb4f33e82a2c4851fade486bd449793a39718d49bc357efd09689150aedd277c5ebcf79b5ebb4bbe36f0cbb72510a50398bee804ffd9c889604e3

Download Submit
memory/2696-125-0x0000000005AE0000-0x0000000005FDE000-memory.dmp

Filesize
5.0MB

Download
memory/2696-121-0x00000000059F0000-0x00000000059F1000-memory.dmp

Filesize
4KB

Download
memory/2696-122-0x00000000059B0000-0x00000000059B1000-memory.dmp

Filesize
4KB

Download
memory/2696-123-0x00000000059E0000-0x00000000059E8000-memory.dmp

Filesize
32KB

Download
memory/2696-124-0x0000000005F50000-0x0000000005F51000-memory.dmp

Filesize
4KB

Download
memory/2696-118-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2696-126-0x00000000067C0000-0x00000000067C1000-memory.dmp

Filesize
4KB

Download
memory/2696-127-0x0000000006960000-0x00000000069DB000-memory.dmp

Filesize
492KB

Download
memory/2696-120-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Filesize
4KB

Download
memory/3416-128-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3416-129-0x000000000042052E-mapping.dmp

Download
memory/3416-135-0x00000000053E0000-0x00000000058DE000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads