snakekeylogger | 6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066

General

Target

NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
Size

610KB
MD5

607e77f9ca12ba956cb67200c50d4af7
SHA1

2ab62a18b91f49aeabbba8d95c6df254b1d8fca8
SHA256

6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066
SHA512

e1f891da4ee8966ff7def571d4cedf609f2e087b50c29ec9a062dc4a8a452ee7a3650d251e5a2188490bb27b0a2681eed441750ad9d42d644a081324668dddb3
SSDEEP

12288:7MqkMPgR/mZRM+BN3SscBiUSnYpJLNRPPD4KUQbwEldtpoj:RgkZR533ToBBfPMNQUEQ

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.gkas.com.tr
Port:
587
Username:
[email protected]
Password:
Gkasteknik@2022

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4496-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 checkip.dyndns.org

flow	ioc
24	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

description	pid	process	target process
PID 228 set thread context of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4736 4496 WerFault.exe NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

pid	pid_target	process	target process
4736	4496	WerFault.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exeNEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

pid	process
228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
4496	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exeNEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

description	pid	process
Token: SeDebugPrivilege	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
Token: SeDebugPrivilege	4496	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

description	pid	process	target process
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
PID 228 wrote to memory of 4496	228	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe	NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228

C:\Users\Admin\AppData\Local\Temp\NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 1536
3⤵
- Program crash
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4496 -ip 4496
1⤵
PID:3656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEAS.6e1277ea70af2c91d96c59af4a71f64a7b1a6633687919a347c570610c578066exe_JC.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/228-8-0x00000000056D0000-0x00000000056DC000-memory.dmp

Filesize
48KB

Download
memory/228-3-0x0000000005550000-0x00000000055E2000-memory.dmp

Filesize
584KB

Download
memory/228-10-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/228-11-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/228-5-0x0000000005610000-0x000000000561A000-memory.dmp

Filesize
40KB

Download
memory/228-6-0x0000000005820000-0x00000000058BC000-memory.dmp

Filesize
624KB

Download
memory/228-7-0x00000000056B0000-0x00000000056CC000-memory.dmp

Filesize
112KB

Download
memory/228-0-0x0000000000AE0000-0x0000000000B80000-memory.dmp

Filesize
640KB

Download
memory/228-9-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/228-2-0x0000000005BF0000-0x0000000006194000-memory.dmp

Filesize
5.6MB

Download
memory/228-4-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/228-12-0x000000000BE30000-0x000000000BE8E000-memory.dmp

Filesize
376KB

Download
memory/228-17-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/228-1-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/4496-16-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download
memory/4496-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4496-18-0x00000000051C0000-0x00000000051D0000-memory.dmp

Filesize
64KB

Download
memory/4496-19-0x0000000074AE0000-0x0000000075290000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads