snakekeylogger | de23cebc6da4b0d92dfa33cf29ae8bd7f5f815cad2b2e56c5942b6682c63dffb

General

Target

f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
Size

822KB
MD5

a58224fec4e31b1904227037339bb386
SHA1

ab9dab1df5b30fbd8ae86ff647df2289cd248477
SHA256

f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d
SHA512

5c33f96be1abf2aeda503cfc447b60cb0517075973dc4111ee4bed8c7015fefe9a72fddaab3462e3ae97220bf7d2ff82fd4b5ce26e0039f6db3a3ff9891212ce
SSDEEP

24576:la/5u61WhDgRtBnIr7OzMSdQLp1Qtog8:mLj07OzMvQ

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5840124995:AAGi31dILVtDYO1HP2N79Va2yxeBSeoN0GY/sendMessage?chat_id=1467583453

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

resource	yara_rule
behavioral1/memory/1088-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1088-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1088-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1088-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1088-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1088-71-0x0000000000630000-0x0000000000670000-memory.dmp	family_snakekeylogger
behavioral1/memory/1088-72-0x0000000000630000-0x0000000000670000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
1088	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
Token: SeDebugPrivilege	1088	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28
PID 1340 wrote to memory of 1088	1340	f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe	28

C:\Users\Admin\AppData\Local\Temp\f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
"C:\Users\Admin\AppData\Local\Temp\f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe
  "C:\Users\Admin\AppData\Local\Temp\f8c1925693a82d8a544bedcf975160a6cbd8a0d0e2a463e402402d8d28ad6e8d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1088-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1088-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1088-72-0x0000000000630000-0x0000000000670000-memory.dmp

Filesize
256KB

Download
memory/1088-71-0x0000000000630000-0x0000000000670000-memory.dmp

Filesize
256KB

Download
memory/1088-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1088-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1088-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1088-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1088-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1088-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1340-55-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1340-60-0x0000000000460000-0x0000000000488000-memory.dmp

Filesize
160KB

Download
memory/1340-54-0x0000000000DB0000-0x0000000000E84000-memory.dmp

Filesize
848KB

Download
memory/1340-59-0x0000000005F40000-0x0000000005FE0000-memory.dmp

Filesize
640KB

Download
memory/1340-58-0x0000000000220000-0x000000000022C000-memory.dmp

Filesize
48KB

Download
memory/1340-57-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1340-56-0x0000000000200000-0x0000000000214000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing