snakekeylogger | f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2

General

Target

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
Size

418KB
MD5

c9af48797367146725c1355060ad6733
SHA1

9a0e59f47659ac02f92ea9d287f6d6dbbc65a4c2
SHA256

f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2
SHA512

68f226bff322257c8a5721989547837d6a8bf5150eb25e91f5012879f9f663fe0007506288927a484c06b69c69e354db67bd4f05d3e8bab9e7c7cf2c254e8ef6
SSDEEP

6144:R/2WTS7RXwn5F8lwOazRkY/loOHO4jUDE2EteYOtYYE2Odtyqd72fJ:RuYF8lwOazxloAqFEtZlYrOiqo

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.hahcd.com
Port:
587
Username:
[email protected]
Password:
d5ClGOqbU6HU
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2400-9-0x0000000000400000-0x000000000041A000-memory.dmp	family_snakekeylogger
behavioral1/memory/2400-11-0x0000000000400000-0x000000000041A000-memory.dmp	family_snakekeylogger
behavioral1/memory/2400-15-0x0000000000400000-0x000000000041A000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

description	pid	process	target process
PID 2192 set thread context of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

description	pid	process	target process
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2192 wrote to memory of 2400	2192	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2192

C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
2⤵
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-0-0x00000000003C0000-0x000000000042E000-memory.dmp

Filesize
440KB

Download
memory/2192-1-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2192-2-0x0000000000910000-0x000000000095A000-memory.dmp

Filesize
296KB

Download
memory/2192-3-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/2192-4-0x0000000000960000-0x000000000096A000-memory.dmp

Filesize
40KB

Download
memory/2192-17-0x0000000073EB0000-0x000000007459E000-memory.dmp

Filesize
6.9MB

Download
memory/2400-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-9-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-11-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2400-15-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2400-16-0x00000000003C0000-0x00000000003C0000-memory.dmp

Download
memory/2400-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads