snakekeylogger | 584fb6b46f6916da661e9f67768154428400af0134fa01d11142f2b4d5e6b303

General

Target

9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe
Size

744KB
MD5

f99d5a071e38ed4add47c1d47f657422
SHA1

94dbd1b97186229391c002d8f4b7aa1f65b386d4
SHA256

9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d
SHA512

3031c8ba5236d04571a4849656c2d5ed5c54c18e98100beb91738b45f02332d60560aa42132be84b29d3598536d6b5472e3aa019c533a2029bd81fbe1a80647b
SSDEEP

12288:gifU3XkzmeoZcEws6AVBYltazIYTX/5J3JFsjx+MNo91XIkrqQqtxPHEoqBChsMe:gOLzD6cEwHAValtazXb5FJCFjeyk1qtO

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6011587164:AAE511fkFXh2HFxNMsjh7DJ7AykzyWIVuaY/sendMessage?chat_id=6197263581

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

resource	yara_rule
behavioral1/memory/1512-67-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-72-0x0000000004860000-0x00000000048A0000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-73-0x0000000004860000-0x00000000048A0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1512	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1512	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27
PID 920 wrote to memory of 1512	920	9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe	27

C:\Users\Admin\AppData\Local\Temp\9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe
"C:\Users\Admin\AppData\Local\Temp\9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:920
- C:\Users\Admin\AppData\Local\Temp\9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe
  "C:\Users\Admin\AppData\Local\Temp\9f7e4c0f47ffa44b03cc568541e5b1c5e2a1a2cbf8d30585129f11a5253ca20d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-54-0x0000000000030000-0x00000000000F0000-memory.dmp

Filesize
768KB

Download
memory/920-55-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/920-56-0x0000000005A90000-0x0000000005B54000-memory.dmp

Filesize
784KB

Download
memory/920-57-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/920-58-0x00000000004F0000-0x0000000000504000-memory.dmp

Filesize
80KB

Download
memory/920-59-0x0000000000500000-0x000000000050C000-memory.dmp

Filesize
48KB

Download
memory/920-60-0x0000000005C80000-0x0000000005D20000-memory.dmp

Filesize
640KB

Download
memory/920-61-0x00000000005D0000-0x00000000005F8000-memory.dmp

Filesize
160KB

Download
memory/1512-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-67-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1512-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-71-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-72-0x0000000004860000-0x00000000048A0000-memory.dmp

Filesize
256KB

Download
memory/1512-73-0x0000000004860000-0x00000000048A0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing