snakekeylogger | f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2

General

Target

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
Size

418KB
MD5

c9af48797367146725c1355060ad6733
SHA1

9a0e59f47659ac02f92ea9d287f6d6dbbc65a4c2
SHA256

f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2
SHA512

68f226bff322257c8a5721989547837d6a8bf5150eb25e91f5012879f9f663fe0007506288927a484c06b69c69e354db67bd4f05d3e8bab9e7c7cf2c254e8ef6
SSDEEP

6144:R/2WTS7RXwn5F8lwOazRkY/loOHO4jUDE2EteYOtYYE2Odtyqd72fJ:RuYF8lwOazxloAqFEtZlYrOiqo

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.hahcd.com
Port:
587
Username:
[email protected]
Password:
d5ClGOqbU6HU

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.hahcd.com
Port:
587
Username:
[email protected]
Password:
d5ClGOqbU6HU
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4276-8-0x0000000000400000-0x000000000041A000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 checkip.dyndns.org

flow	ioc
27	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

description	pid	process	target process
PID 2000 set thread context of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

pid process

4276 NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

description pid process

Token: SeDebugPrivilege 4276 NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

pid	process
4276	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

description	pid	process
Token: SeDebugPrivilege	4276	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

description	pid	process	target process
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
PID 2000 wrote to memory of 4276	2000	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe	NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEAS.f347fc090da11031ce00a0a7fb7330c37c921422939e54d8df7202487f3c15c2exe_JC.exe.log

Filesize
706B

MD5
2ef5ef69dadb8865b3d5b58c956077b8

SHA1
af2d869bac00685c745652bbd8b3fe82829a8998

SHA256
363502eb2a4e53ba02d2d85412b901fcf8e06de221736bdffa949799ef3d21e3

SHA512
66d4db5dd17d88e1d54ea0df3a7211a503dc4355de701259cefccc9f2e4e3ced9534b700099ffbb089a5a3acb082011c80b61801aa14aff76b379ce8f90d4fd3

Download Submit
memory/2000-3-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/2000-12-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/2000-0-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/2000-4-0x00000000050C0000-0x000000000510A000-memory.dmp

Filesize
296KB

Download
memory/2000-5-0x0000000005200000-0x0000000005210000-memory.dmp

Filesize
64KB

Download
memory/2000-6-0x0000000005210000-0x00000000052AC000-memory.dmp

Filesize
624KB

Download
memory/2000-7-0x0000000005150000-0x000000000515A000-memory.dmp

Filesize
40KB

Download
memory/2000-2-0x0000000005670000-0x0000000005C14000-memory.dmp

Filesize
5.6MB

Download
memory/2000-1-0x00000000005D0000-0x000000000063E000-memory.dmp

Filesize
440KB

Download
memory/4276-11-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4276-8-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4276-13-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4276-14-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4276-15-0x0000000006C00000-0x0000000006C0A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads