snakekeylogger | ce55bc768091b061f2d942263ef8c7aa9a6d6dd7eb0038afb79ea990588e5c42

General

Target

INV-11423.exe
Size

474KB
MD5

4e5ea0fc9708d927493464141a56e1b1
SHA1

d4a70dab3e55236ddb3e25ad1f26e92a85a6c407
SHA256

ce55bc768091b061f2d942263ef8c7aa9a6d6dd7eb0038afb79ea990588e5c42
SHA512

9a32fd3338fa3243dddbccd55af2159d942f3bd290395d2b23530748dc725c02cee3c7380f6cb12d6594119413f446d0db0942c0d56bf31d4dadaf7d95829aa9

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1400-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1400-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1400-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1400-68-0x000000000042028E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1400-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1400-72-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

INV-11423.exe

description pid process target process

PID 1796 set thread context of 1400 1796 INV-11423.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1912 1400 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegSvcs.exe

pid process

1400 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1400 RegSvcs.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 1796 set thread context of 1400	1796	INV-11423.exe	RegSvcs.exe

pid	pid_target	process	target process
1912	1400	WerFault.exe	RegSvcs.exe

pid	process
1400	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1400	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

INV-11423.exeRegSvcs.exe

description	pid	process	target process
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1796 wrote to memory of 1400	1796	INV-11423.exe	RegSvcs.exe
PID 1400 wrote to memory of 1912	1400	RegSvcs.exe	WerFault.exe
PID 1400 wrote to memory of 1912	1400	RegSvcs.exe	WerFault.exe
PID 1400 wrote to memory of 1912	1400	RegSvcs.exe	WerFault.exe
PID 1400 wrote to memory of 1912	1400	RegSvcs.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1076
3⤵
- Program crash
PID:1912

memory/1400-68-0x000000000042028E-mapping.dmp

Download
memory/1400-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1400-72-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1400-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1400-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1400-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1400-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1400-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1796-58-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/1796-60-0x0000000000EC0000-0x0000000000EE6000-memory.dmp

Filesize
152KB

Download
memory/1796-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1796-59-0x0000000004FA0000-0x000000000500A000-memory.dmp

Filesize
424KB

Download
memory/1796-54-0x0000000001130000-0x00000000011AC000-memory.dmp

Filesize
496KB

Download
memory/1796-57-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/1796-56-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/1912-74-0x0000000000000000-mapping.dmp

Download