snakekeylogger | 334532817a3d2ab7c3043fe908ca9040c4f4fc82ac7cb640f3e64befa0773d3b

General

Target
kHOCeq3NWohVYTq.exe
Size 758KB
Sample220405-fx5btsdddl
SHA256 334532817a3d2ab7c3043fe908ca9040c4f4fc82ac7cb640f3e64befa0773d3b
MD5 32afe614ea910cca4c4ca2f1ce302f98
SHA1 fdce67d9d51e455c598d709f56a4466ab23f857c
SHA512 8ffb5e35353be393b3f3aad3d2f3a14286fd766dc6bae2a2417a79a1e721c75aa27d6128765607fd035d1bbeb654ca795727e44834b9f4960d5452936558cb95
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5279957204:AAHEhhHWe_sLmlrmmaTQQwXjP420KmCuSOY/sendMessage?chat_id=5274798743

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/64-131-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3056 set thread context of 64	3056	kHOCeq3NWohVYTq.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	64	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3056	kHOCeq3NWohVYTq.exe
3056	kHOCeq3NWohVYTq.exe
3056	kHOCeq3NWohVYTq.exe
3056	kHOCeq3NWohVYTq.exe
64	kHOCeq3NWohVYTq.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	kHOCeq3NWohVYTq.exe
Token: SeDebugPrivilege	64	kHOCeq3NWohVYTq.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87
PID 3056 wrote to memory of 64	3056	kHOCeq3NWohVYTq.exe	87

C:\Users\Admin\AppData\Local\Temp\kHOCeq3NWohVYTq.exe
"C:\Users\Admin\AppData\Local\Temp\kHOCeq3NWohVYTq.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\kHOCeq3NWohVYTq.exe
  "C:\Users\Admin\AppData\Local\Temp\kHOCeq3NWohVYTq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 1532
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 64 -ip 64
1⤵
PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

kHOCeq3NWohVYTq.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\kHOCeq3NWohVYTq.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/64-131-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3056-124-0x00000000004B0000-0x0000000000574000-memory.dmp

Download

memory/3056-125-0x0000000005420000-0x00000000059C4000-memory.dmp

Download

memory/3056-126-0x0000000004F50000-0x0000000004FE2000-memory.dmp

Download

memory/3056-127-0x0000000004F40000-0x0000000004F4A000-memory.dmp

Download

memory/3056-128-0x0000000008830000-0x00000000088CC000-memory.dmp

Download

memory/3056-129-0x0000000008C70000-0x0000000008CD6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads