snakekeylogger | 77f8350466c08e326fb01ca8a0e4fe1ea8904af934d0297a24b29c6ed48112d9

General

Target
CERTEX INQUIRY.exe
Size 1.5MB
Sample220609-mz4lmsfcan
SHA256 77f8350466c08e326fb01ca8a0e4fe1ea8904af934d0297a24b29c6ed48112d9
MD5 f508facc3ba6e7d56195998f14eba7a7
SHA1 d8903ee3d7852bc930658605cf73337cdbcbac3f
SHA512 10939aa3ffeb6699407850f9f44c98a05c3ce92b5beb7375eae3b15d59c080849cb2e8402b4d8f641f6d80a540ee241b3e1cf03eff31d1917d5556fb86821cbd
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.eurosalesman.world
Port
587
Username
[email protected]
Password
Saabttid082019
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3672-138-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1508 set thread context of 3672	1508	CERTEX INQUIRY.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3464	3672	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1508	CERTEX INQUIRY.exe
1508	CERTEX INQUIRY.exe
3672	CERTEX INQUIRY.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	CERTEX INQUIRY.exe
Token: SeDebugPrivilege	3672	CERTEX INQUIRY.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 3612	1508	CERTEX INQUIRY.exe	81
PID 1508 wrote to memory of 3612	1508	CERTEX INQUIRY.exe	81
PID 1508 wrote to memory of 3612	1508	CERTEX INQUIRY.exe	81
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82
PID 1508 wrote to memory of 3672	1508	CERTEX INQUIRY.exe	82

C:\Users\Admin\AppData\Local\Temp\CERTEX INQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\CERTEX INQUIRY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\CERTEX INQUIRY.exe
  "C:\Users\Admin\AppData\Local\Temp\CERTEX INQUIRY.exe"
  2⤵
  PID:3612
- C:\Users\Admin\AppData\Local\Temp\CERTEX INQUIRY.exe
  "C:\Users\Admin\AppData\Local\Temp\CERTEX INQUIRY.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 1536
    3⤵
    - Program crash
    PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
1⤵
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

CERTEX INQUIRY.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CERTEX INQUIRY.exe.log
Size 886B
SHA256 537028f9a060bae450a8a7b2409ac4c14dc2732eecce1609bad8684411819406
MD5 737df710de5690e8dcf11cbac5a717bc
SHA1 a0d04767b1b543f6634283519931927314cd35a5
SHA512 508320eec49f7224afcf8b12a0d273928acc8bcbd3ba456e0a4128bf8ce4fd7e48390fb95369088eed93a3ffc03fe9cfd0b2f76ae3d138f0456d8be1d0497c7a
MD5 SHA1 SHA512

Submit Download

memory/1508-130-0x0000000000E70000-0x0000000000FFA000-memory.dmp

Download

memory/1508-131-0x0000000006060000-0x0000000006604000-memory.dmp

Download

memory/1508-132-0x00000000059C0000-0x0000000005A52000-memory.dmp

Download

memory/1508-133-0x0000000005AB0000-0x0000000005B26000-memory.dmp

Download

memory/1508-134-0x0000000005A80000-0x0000000005A9E000-memory.dmp

Download

memory/1508-135-0x0000000005E30000-0x0000000005ECC000-memory.dmp

Download

memory/3672-138-0x0000000000400000-0x000000000047C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads