snakekeylogger | 0dd0c3082323a331ad2d5d36f5f7f3ac11826772077df7462da3229525d97862

General

Target

9336e1b94359080686ac7d96212cd60c.exe
Size

458KB
MD5

9336e1b94359080686ac7d96212cd60c
SHA1

8cccdb6b4fbd9eee8ba4fe398c32da41f160b6f3
SHA256

0dd0c3082323a331ad2d5d36f5f7f3ac11826772077df7462da3229525d97862
SHA512

5a3ccf855581e51a188eee350928dbb56293ba345490b188207101f0ddb4162b5ca0eae12d0a65aedb6255be9e989c25d33d25a21a2d238b064892af24563ba1
SSDEEP

6144:Rk5+kbkZJ0aU7BfOp+1nRReEgNac8E9baVa0+f9g819Ri9WFYop10:Rk5Zki1pPOocCVax919RaW+w2

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1696-7-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1696-8-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1696-11-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1696-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1696-15-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

9336e1b94359080686ac7d96212cd60c.exe

description pid process target process

PID 1988 set thread context of 1696 1988 9336e1b94359080686ac7d96212cd60c.exe RegAsm.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1696 WerFault.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

1696 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1696 RegAsm.exe

flow	ioc
4	checkip.dyndns.org

description	pid	process	target process
PID 1988 set thread context of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe

pid	pid_target	process	target process
3004	1696	WerFault.exe	RegAsm.exe

pid	process
1696	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1696	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

9336e1b94359080686ac7d96212cd60c.exeRegAsm.exe

description	pid	process	target process
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1988 wrote to memory of 1696	1988	9336e1b94359080686ac7d96212cd60c.exe	RegAsm.exe
PID 1696 wrote to memory of 3004	1696	RegAsm.exe	WerFault.exe
PID 1696 wrote to memory of 3004	1696	RegAsm.exe	WerFault.exe
PID 1696 wrote to memory of 3004	1696	RegAsm.exe	WerFault.exe
PID 1696 wrote to memory of 3004	1696	RegAsm.exe	WerFault.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 1212
3⤵
- Program crash
PID:3004

memory/1696-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1696-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1696-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1988-1-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-0-0x0000000000D90000-0x0000000000E08000-memory.dmp

Filesize
480KB

Download
memory/1988-4-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1988-3-0x0000000000D20000-0x0000000000D60000-memory.dmp

Filesize
256KB

Download
memory/1988-2-0x0000000000670000-0x00000000006A6000-memory.dmp

Filesize
216KB

Download
memory/1988-16-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download