snakekeylogger | 64ef1f3617be869ae5492ff2fb24a461ffef5000cb22a081d85e767ff6ff7f5f

General

Target
4bb3b44e6bdf5dcb41162b241449ab01.exe
Size 793KB
Sample220712-j3tztscce8
SHA256 64ef1f3617be869ae5492ff2fb24a461ffef5000cb22a081d85e767ff6ff7f5f
MD5 4bb3b44e6bdf5dcb41162b241449ab01
SHA1 005c8374955682204640f170c219aec850516f14
SHA512 937d0f62941c88c9fd49753b5d9b1453095b1ac976c13056dc32e7fa4fea21dd7740a45f802436a96cc7a6b9986ae474be882b07805bc1ef1719eea0d3448eab
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
cp5ua.hyperhost.ua
Port
587
Username
[email protected]
Password
7213575aceACE@#$
Email to
[email protected]

C2

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2232-137-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4876 set thread context of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	4876	WerFault.exe	77

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	4bb3b44e6bdf5dcb41162b241449ab01.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	4bb3b44e6bdf5dcb41162b241449ab01.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82
PID 4876 wrote to memory of 2232	4876	4bb3b44e6bdf5dcb41162b241449ab01.exe	82

C:\Users\Admin\AppData\Local\Temp\4bb3b44e6bdf5dcb41162b241449ab01.exe
"C:\Users\Admin\AppData\Local\Temp\4bb3b44e6bdf5dcb41162b241449ab01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\4bb3b44e6bdf5dcb41162b241449ab01.exe
  "C:\Users\Admin\AppData\Local\Temp\4bb3b44e6bdf5dcb41162b241449ab01.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 1456
  2⤵
  - Program crash
  PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4876 -ip 4876
1⤵
PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

4bb3b44e6bdf5dcb41162b241449ab01.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4bb3b44e6bdf5dcb41162b241449ab01.exe.log
Size 1KB
SHA256 a75686eed807c36b056311dddc898582fd4063135fc5728d2bdd3c6e1f5ab688
MD5 fc57dcb1a143324278cf61d88f8c67ad
SHA1 807d546b4296091d11a8df6a11157a5f12dd7fd5
SHA512 33ac55a68ac8371bf00af55e38455e886dc6aa681388622a55bf4473b1f4eda4d75a8211ea61df288ccdb26e838785da08094a7f1aac878da6ccd2e573f3bcb8
MD5 SHA1 SHA512

Submit Download

memory/2232-137-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4876-130-0x0000000000050000-0x000000000011C000-memory.dmp

Download

memory/4876-131-0x0000000005100000-0x00000000056A4000-memory.dmp

Download

memory/4876-132-0x0000000004B50000-0x0000000004BE2000-memory.dmp

Download

memory/4876-133-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Download

memory/4876-134-0x0000000008440000-0x00000000084DC000-memory.dmp

Download

memory/4876-135-0x0000000000AF0000-0x0000000000B56000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads