snakekeylogger | 3c9ce8f9ea12d33121cbed04a9cd55ace12062949b7bb3dafe37f1f0a55f1eff

General

Target

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
Size

628KB
MD5

c8fa93aa2b19901add93130d7e19ac8c
SHA1

674ddfbbde28933ccd2c45192ab1fe864ce8fda8
SHA256

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b
SHA512

4aa0519657f0fc4589e25a0cfdf954782aa8c2b9f756655eb79f428350786f7a9492b8be979eb235010d3e6c8e2cd8b31adb8482e580e47b4752b6f087209b27
SSDEEP

12288:0WOTNXc33HunBAFnS1GDtb7AufW1mIzAnf0EFQWhf3lnacr6aSTr:j3XuBqSOqNmIzAcEFdhf5a+

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6630888620:AAE93xtVx5O2Dxt-GABfyfFS0US096iv3q8/sendMessage?chat_id=1467583453

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1548-20-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1548-23-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1548-25-0x0000000004C80000-0x0000000004CC0000-memory.dmp	family_snakekeylogger
behavioral1/memory/1548-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1548-14-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1548-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

description	pid	process	target process
PID 2248 set thread context of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exeb161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

pid	process
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1548	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exeb161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

description	pid	process
Token: SeDebugPrivilege	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
Token: SeDebugPrivilege	1548	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

description	pid	process	target process
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
PID 2248 wrote to memory of 1548	2248	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
"C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
"C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-24-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-25-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/1548-27-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/1548-26-0x0000000074AE0000-0x00000000751CE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-23-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1548-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2248-6-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2248-3-0x0000000000390000-0x00000000003A6000-memory.dmp

Filesize
88KB

Download
memory/2248-4-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download
memory/2248-0-0x00000000013B0000-0x0000000001452000-memory.dmp

Filesize
648KB

Download
memory/2248-2-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2248-7-0x0000000004860000-0x00000000048C0000-memory.dmp

Filesize
384KB

Download
memory/2248-1-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download
memory/2248-5-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/2248-21-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads