snakekeylogger | 76a7f3ea3965896cf16bc921fc73a4d3a85abb7a80125ba29e3c1088a4ae4d15

General

Target

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe
Size

366KB
MD5

3c1ade1441ef11aed8496b742eab197b
SHA1

06ebde82c367791c03196888fb2fcc7721296564
SHA256

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738
SHA512

79f35c1f552040fd3f5273aa288bbcc86662a325dc9fd5c1817d127568a5edd3337c9b124583c3e09d07c446dcdc2b6b515227ec0d987b6b8444f342046715a6
SSDEEP

6144:L0nJBIKD2SJMz2dR8rZNlvzGSTo5xBB9VVh8YZWUBwDPlj3y4QTdk6ceh9X3P92D:sJfD2S+nRqx39Xh88VBIlzy4Qpk6ceXx

Score

10^/10

Family

snakekeylogger

C2

https://api.telegram.org/bot6243209595:AAGECSmdSqJiVZcdFoBvotoaKcKT9Lz5Gvw/sendMessage?chat_id=1070926352

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-9-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-11-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-15-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-17-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-19-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe

description	pid	process	target process
PID 2208 set thread context of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

1964 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1964 RegAsm.exe

pid	process
1964	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1964	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe

description	pid	process	target process
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 2208 wrote to memory of 1964	2208	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe

memory/1964-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1964-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1964-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2208-1-0x0000000001080000-0x00000000010E2000-memory.dmp

Filesize
392KB

Download
memory/2208-0-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-4-0x0000000000920000-0x000000000092A000-memory.dmp

Filesize
40KB

Download
memory/2208-3-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/2208-20-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-2-0x00000000003F0000-0x0000000000444000-memory.dmp

Filesize
336KB

Download