snakekeylogger | 3c4b8818b3e073f0e5ac71ad850ae2ef3f1a5270d99169ee9892fe86977642af

General

Target

CaixaBank _ banca digital CaixaBankNow.exe
Size

767KB
MD5

4b6be38cb9bf11d6dfe312668ada7616
SHA1

fef22666290a4dea202b4cce1ad934af6f61fd56
SHA256

3c4b8818b3e073f0e5ac71ad850ae2ef3f1a5270d99169ee9892fe86977642af
SHA512

2682673865311c2eda1c862f45974c5f43ff22357d8ccf849f91a8339a0095b1c7a1acf19ada128ef62c399eaf5ef61cd7f5e8e82b56df5fecc115a65ecefa81
SSDEEP

12288:Lx+OSUAh3NVr572iNa7xdvo/MdyrhFgtDsuBHsSj5J4+saBGHfNP4yKylHaC1Z4h:0N1U9BqmycgiH75BMNP4yKDr3RXl/o1m

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.mutuadebasto.pt
Port:
587
Username:
fernando.basto@mutuadebasto.pt
Password:
mutua_Fernando123
Email To:
brownrocketss@gmail.com

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1512-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-71-0x0000000004360000-0x00000000043A0000-memory.dmp	family_snakekeylogger
behavioral1/memory/1512-72-0x0000000004360000-0x00000000043A0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

CaixaBank _ banca digital CaixaBankNow.exe

description	pid	process	target process
PID 1200 set thread context of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

CaixaBank _ banca digital CaixaBankNow.exeCaixaBank _ banca digital CaixaBankNow.exe

pid process

1200 CaixaBank _ banca digital CaixaBankNow.exe
1200 CaixaBank _ banca digital CaixaBankNow.exe
1512 CaixaBank _ banca digital CaixaBankNow.exe

pid	process
1200	CaixaBank _ banca digital CaixaBankNow.exe
1200	CaixaBank _ banca digital CaixaBankNow.exe
1512	CaixaBank _ banca digital CaixaBankNow.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CaixaBank _ banca digital CaixaBankNow.exeCaixaBank _ banca digital CaixaBankNow.exe

description	pid	process
Token: SeDebugPrivilege	1200	CaixaBank _ banca digital CaixaBankNow.exe
Token: SeDebugPrivilege	1512	CaixaBank _ banca digital CaixaBankNow.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

CaixaBank _ banca digital CaixaBankNow.exe

description	pid	process	target process
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe
PID 1200 wrote to memory of 1512	1200	CaixaBank _ banca digital CaixaBankNow.exe	CaixaBank _ banca digital CaixaBankNow.exe

C:\Users\Admin\AppData\Local\Temp\CaixaBank _ banca digital CaixaBankNow.exe
"C:\Users\Admin\AppData\Local\Temp\CaixaBank _ banca digital CaixaBankNow.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\CaixaBank _ banca digital CaixaBankNow.exe
"C:\Users\Admin\AppData\Local\Temp\CaixaBank _ banca digital CaixaBankNow.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-54-0x0000000000E10000-0x0000000000ED6000-memory.dmp

Filesize
792KB

Download
memory/1200-55-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/1200-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1200-57-0x00000000047D0000-0x0000000004810000-memory.dmp

Filesize
256KB

Download
memory/1200-58-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/1200-59-0x0000000004EB0000-0x0000000004F14000-memory.dmp

Filesize
400KB

Download
memory/1200-60-0x0000000004750000-0x000000000477A000-memory.dmp

Filesize
168KB

Download
memory/1512-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1512-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1512-71-0x0000000004360000-0x00000000043A0000-memory.dmp

Filesize
256KB

Download
memory/1512-72-0x0000000004360000-0x00000000043A0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads