snakekeylogger | 98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86

General

Target

NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
Size

332KB
MD5

b5fbcda9d5577a1348fd66393e834c38
SHA1

de3a6bbabc63574238cdc3f78058fa752da31da0
SHA256

98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86
SHA512

bdd64acc3de80f6ca506639a989ca0dc5947e856913a7937ffd71726fed07f633c005ae70a3b53dc735d432ae78b67888870afa53e06e191c7f749fbf3ee8a53
SSDEEP

6144:JEasJm3yZ1bHuuywQ7sUeFb2KnZFsTxvULZYE2Odtyqd72fBQD:JEyHutZFG0YrOiqoW

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.noscoegypt.com
Port:
465
Username:
[email protected]
Password:
j3w[Ok%-wW,@
Email To:
URL: mail.noscoegypt.com

C2

https://api.telegram.org/bot6812788177:AAGkIGRh-hqEtxCxIbq-Dbm2V68_RxIRo8c/sendMessage?chat_id=5007084465

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1008-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1008-20-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1008-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1008-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1008-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe

description	pid	process	target process
PID 2040 set thread context of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

2300 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2300 Powershell.exe

pid	process
2300	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	2300	Powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe

description	pid	process	target process
PID 2040 wrote to memory of 2300	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	Powershell.exe
PID 2040 wrote to memory of 2300	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	Powershell.exe
PID 2040 wrote to memory of 2300	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	Powershell.exe
PID 2040 wrote to memory of 2300	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	Powershell.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
PID 2040 wrote to memory of 1008	2040	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe	NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\grace.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Users\Admin\AppData\Local\Temp\NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.98c19753dbee8352bb450feb4d842079a04b17456e21761e713b9d481b00ac86.exe
2⤵
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-22-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1008-25-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1008-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1008-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1008-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2040-21-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2040-0-0x0000000000CC0000-0x0000000000D1A000-memory.dmp

Filesize
360KB

Download
memory/2040-2-0x0000000000C20000-0x0000000000C76000-memory.dmp

Filesize
344KB

Download
memory/2040-9-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/2040-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-6-0x000000006FE90000-0x000000007043B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-8-0x0000000002360000-0x00000000023A0000-memory.dmp

Filesize
256KB

Download
memory/2300-7-0x0000000002360000-0x00000000023A0000-memory.dmp

Filesize
256KB

Download
memory/2300-5-0x000000006FE90000-0x000000007043B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-24-0x000000006FE90000-0x000000007043B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads