snakekeylogger | b5c4a88587318ebe3e7342fd47879fbd7851130d7c81e15b2033f3a8a2f8a7e3

General

Target

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
Size

628KB
MD5

c8fa93aa2b19901add93130d7e19ac8c
SHA1

674ddfbbde28933ccd2c45192ab1fe864ce8fda8
SHA256

b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b
SHA512

4aa0519657f0fc4589e25a0cfdf954782aa8c2b9f756655eb79f428350786f7a9492b8be979eb235010d3e6c8e2cd8b31adb8482e580e47b4752b6f087209b27
SSDEEP

12288:0WOTNXc33HunBAFnS1GDtb7AufW1mIzAnf0EFQWhf3lnacr6aSTr:j3XuBqSOqNmIzAcEFdhf5a+

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6630888620:AAE93xtVx5O2Dxt-GABfyfFS0US096iv3q8/sendMessage?chat_id=1467583453

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/2748-10-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2748-11-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2748-14-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2748-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2748-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2748-21-0x00000000005A0000-0x00000000005E0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1864 set thread context of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
2748	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
Token: SeDebugPrivilege	2748	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1084	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	29
PID 1864 wrote to memory of 1084	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	29
PID 1864 wrote to memory of 1084	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	29
PID 1864 wrote to memory of 1084	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	29
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30
PID 1864 wrote to memory of 2748	1864	b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe	30

C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
"C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
  "C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe"
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe
  "C:\Users\Admin\AppData\Local\Temp\b161be7554c0f571a5ae4db7a8c9ea60e7126c589339073b7c0aaacbd5679e9b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-0-0x0000000001230000-0x00000000012D2000-memory.dmp

Filesize
648KB

Download
memory/1864-1-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1864-2-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1864-3-0x0000000000340000-0x0000000000356000-memory.dmp

Filesize
88KB

Download
memory/1864-4-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/1864-5-0x0000000004980000-0x00000000049E0000-memory.dmp

Filesize
384KB

Download
memory/1864-6-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1864-7-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1864-19-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2748-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2748-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2748-20-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2748-21-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2748-22-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/2748-23-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing