snakekeylogger | 2c0096a156e0e652f2a5e45df812b92554b4ecda252d634daa9b13c69ced3c20

General

Target
INQUIRY_019278393.exe
Size 1.7MB
Sample220404-mc32lahbfj
SHA256 2c0096a156e0e652f2a5e45df812b92554b4ecda252d634daa9b13c69ced3c20
MD5 d9cad25bdc250200602b1254253765e8
SHA1 a36bfc30cde821cb4052556be600838bd6098cca
SHA512 6a9bf2cf299f9be3a2bcf17be3e3c76882bf018e8273d6ffba4cb8bba8851f5cf0193a8cd093ec375b4bf7cd1afee4baea7c06f2d8f32455bca8fd474a15f9ef
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.alfalahchemicals.com
Port
587
Username
[email protected]
Password
pakistan123456
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1444-61-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger
behavioral1/memory/1444-62-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger
behavioral1/memory/1444-64-0x00000000004770DE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1444-63-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger
behavioral1/memory/1444-66-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger
behavioral1/memory/1444-68-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 1444	364	INQUIRY_019278393.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	1444	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1444	INQUIRY_019278393.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	INQUIRY_019278393.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 364 wrote to memory of 1444	364	INQUIRY_019278393.exe	28
PID 1444 wrote to memory of 560	1444	INQUIRY_019278393.exe	29
PID 1444 wrote to memory of 560	1444	INQUIRY_019278393.exe	29
PID 1444 wrote to memory of 560	1444	INQUIRY_019278393.exe	29
PID 1444 wrote to memory of 560	1444	INQUIRY_019278393.exe	29

C:\Users\Admin\AppData\Local\Temp\INQUIRY_019278393.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY_019278393.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\INQUIRY_019278393.exe
  "C:\Users\Admin\AppData\Local\Temp\INQUIRY_019278393.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1140
    3⤵
    - Program crash
    PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-54-0x0000000000850000-0x0000000000A12000-memory.dmp

Download

memory/364-55-0x00000000757D1000-0x00000000757D3000-memory.dmp

Download

memory/364-56-0x0000000004D80000-0x0000000004EF8000-memory.dmp

Download

memory/364-57-0x0000000000280000-0x0000000000296000-memory.dmp

Download

memory/1444-61-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/1444-59-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/1444-62-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/1444-63-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/1444-66-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/1444-68-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/1444-58-0x0000000000400000-0x000000000047C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads