snakekeylogger | 0a67ff35add751a754db8f7d55515b0dbac034b87274cfd1cc351f7679a98b2f

General

Target
63b1a4c132a3548417961c472caa826f.exe
Size 567KB
Sample220330-gw2d8adcdp
SHA256 0a67ff35add751a754db8f7d55515b0dbac034b87274cfd1cc351f7679a98b2f
MD5 63b1a4c132a3548417961c472caa826f
SHA1 5aa0027a9f76c8f0521671bf2b925a6169546650
SHA512 cde6a0e8e748fb86919cfd150cf87a4756e1077e62d7184d456c24a41be4ae88588b3aaeeb1b07ec9d426e031d6cf181235e87d076cf672fd12b63da8d8ad70e
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1656-136-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger
behavioral2/memory/1656-138-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger
behavioral2/memory/1656-139-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger

Executes dropped EXE 2 IoCs

pid	Process
1224	ydkpg.exe
1656	ydkpg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1224 set thread context of 1656	1224	ydkpg.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2592	1656	WerFault.exe	81

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1224	760	63b1a4c132a3548417961c472caa826f.exe	80
PID 760 wrote to memory of 1224	760	63b1a4c132a3548417961c472caa826f.exe	80
PID 760 wrote to memory of 1224	760	63b1a4c132a3548417961c472caa826f.exe	80
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81
PID 1224 wrote to memory of 1656	1224	ydkpg.exe	81

C:\Users\Admin\AppData\Local\Temp\63b1a4c132a3548417961c472caa826f.exe
"C:\Users\Admin\AppData\Local\Temp\63b1a4c132a3548417961c472caa826f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
  C:\Users\Admin\AppData\Local\Temp\ydkpg.exe C:\Users\Admin\AppData\Local\Temp\fanotpbb
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
    C:\Users\Admin\AppData\Local\Temp\ydkpg.exe C:\Users\Admin\AppData\Local\Temp\fanotpbb
    3⤵
    - Executes dropped EXE
    PID:1656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 428
      4⤵
      Program crash
      PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1656 -ip 1656
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9xfgoph0xm7kbnq

Path C:\Users\Admin\AppData\Local\Temp\9xfgoph0xm7kbnq
Size 540KB
SHA256 07fdd03f26b2d5a2d93a55dd4883246c2bd832b432283f7ba28c33d0b2cf6440
MD5 97864f6e5bcde9199d69f8c62eb03477
SHA1 61f660f0df961877c3cb1b8c57595a608f47c656
SHA512 095dd602b312f43b9d2f55f16c1fa9ffc9fb130750b9235a9471e1a528e01791f7d5fa0c26b5ca0facd9851a7524ccc187784c940cb37b13a3782b79093b4aa5
MD5 SHA1 SHA512

Submit Download

fanotpbb

Path C:\Users\Admin\AppData\Local\Temp\fanotpbb
Size 5KB
SHA256 05b29f860defa1731425be4c972d13ebddce2cf3bca88331f28a31095a01df69
MD5 86ada42d56eec3fa97ec788315b456a7
SHA1 27a8ba0d7976d8e878530c3854b7ea1872cf89c8
SHA512 3778fac088c7f3d220b94f167eb248fc70b0b8b74a9e781f3bcb8a9fad421d62af4e81e21fdc1d7d06fc9fff1535a39cc2726a0e7bb52e762d33b6608c250554
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

ydkpg.exe

Path C:\Users\Admin\AppData\Local\Temp\ydkpg.exe
Size 3KB
SHA256 07d21bfd92cce9645a58b7901230bcd5aa6234fca94535a183457e4ed7760df9
MD5 1ac4edff4ee60549785e34a9fecf582e
SHA1 8c507adbb1d5f0b54473d62d85630a63f81f521f
SHA512 dbfcde10c1219db21be943eaab8eb4f8e0a4b24639bcb8333a706f6ba0aa88452cd3f7f5b9848850a6b94cbbc4f0b4efafd6ec9bde9e6626f39dbd9cf06ec1e4
MD5 SHA1 SHA512

Submit Download

memory/1656-136-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/1656-138-0x0000000000400000-0x000000000048B000-memory.dmp

Download

memory/1656-139-0x0000000000400000-0x000000000048B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads