snakekeylogger | 0a67ff35add751a754db8f7d55515b0dbac034b87274cfd1cc351f7679a98b2f

Analysis

max time kernel
4294189s
max time network
131s
platform
windows7_x64
resource
win7-20220311-en
submitted
30/03/2022, 06:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63b1a4c132a3548417961c472caa826f.exe
Size 567KB
Sample220330-gw2d8adcdp
SHA256 0a67ff35add751a754db8f7d55515b0dbac034b87274cfd1cc351f7679a98b2f
MD5 63b1a4c132a3548417961c472caa826f
SHA1 5aa0027a9f76c8f0521671bf2b925a6169546650
SHA512 cde6a0e8e748fb86919cfd150cf87a4756e1077e62d7184d456c24a41be4ae88588b3aaeeb1b07ec9d426e031d6cf181235e87d076cf672fd12b63da8d8ad70e
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

resource	yara_rule
behavioral1/memory/656-64-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger
behavioral1/memory/656-65-0x000000000040188B-mapping.dmp	family_snakekeylogger
behavioral1/memory/656-69-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1636	ydkpg.exe
656	ydkpg.exe

Loads dropped DLL 5 IoCs

pid	Process
1168	63b1a4c132a3548417961c472caa826f.exe
1168	63b1a4c132a3548417961c472caa826f.exe
1636	ydkpg.exe
392	dw20.exe
392	dw20.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 656	1636	ydkpg.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
656	ydkpg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
392	dw20.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	656	ydkpg.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1636	1168	63b1a4c132a3548417961c472caa826f.exe	27
PID 1168 wrote to memory of 1636	1168	63b1a4c132a3548417961c472caa826f.exe	27
PID 1168 wrote to memory of 1636	1168	63b1a4c132a3548417961c472caa826f.exe	27
PID 1168 wrote to memory of 1636	1168	63b1a4c132a3548417961c472caa826f.exe	27
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 1636 wrote to memory of 656	1636	ydkpg.exe	28
PID 656 wrote to memory of 392	656	ydkpg.exe	29
PID 656 wrote to memory of 392	656	ydkpg.exe	29
PID 656 wrote to memory of 392	656	ydkpg.exe	29
PID 656 wrote to memory of 392	656	ydkpg.exe	29

C:\Users\Admin\AppData\Local\Temp\63b1a4c132a3548417961c472caa826f.exe
"C:\Users\Admin\AppData\Local\Temp\63b1a4c132a3548417961c472caa826f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
  C:\Users\Admin\AppData\Local\Temp\ydkpg.exe C:\Users\Admin\AppData\Local\Temp\fanotpbb
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
    C:\Users\Admin\AppData\Local\Temp\ydkpg.exe C:\Users\Admin\AppData\Local\Temp\fanotpbb
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 944
      4⤵
      Loads dropped DLL
      Suspicious behavior: GetForegroundWindowSpam
      PID:392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9xfgoph0xm7kbnq

Path C:\Users\Admin\AppData\Local\Temp\9xfgoph0xm7kbnq
Size 540KB
SHA256 07fdd03f26b2d5a2d93a55dd4883246c2bd832b432283f7ba28c33d0b2cf6440
MD5 97864f6e5bcde9199d69f8c62eb03477
SHA1 61f660f0df961877c3cb1b8c57595a608f47c656
SHA512 095dd602b312f43b9d2f55f16c1fa9ffc9fb130750b9235a9471e1a528e01791f7d5fa0c26b5ca0facd9851a7524ccc187784c940cb37b13a3782b79093b4aa5
MD5 SHA1 SHA512

Submit Download

fanotpbb

Path C:\Users\Admin\AppData\Local\Temp\fanotpbb
Size 5KB
SHA256 05b29f860defa1731425be4c972d13ebddce2cf3bca88331f28a31095a01df69
MD5 86ada42d56eec3fa97ec788315b456a7
SHA1 27a8ba0d7976d8e878530c3854b7ea1872cf89c8
SHA512 3778fac088c7f3d220b94f167eb248fc70b0b8b74a9e781f3bcb8a9fad421d62af4e81e21fdc1d7d06fc9fff1535a39cc2726a0e7bb52e762d33b6608c250554
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path \Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path \Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path \Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path \Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path \Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

memory/656-64-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/656-69-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/656-70-0x00000000741F0000-0x000000007479B000-memory.dmp

Download

memory/656-71-0x00000000005A2000-0x00000000005A4000-memory.dmp

Download

memory/1168-54-0x00000000759B1000-0x00000000759B3000-memory.dmp

Download