snakekeylogger | da4e35f530529ba949ccadad494028279aa6ff8b340f5b27bcee3bf368e73197

General

Target

93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
Size

593KB
MD5

26048e02ba3f8483fa15e7c0660c4c1e
SHA1

b98cf8f5a2f6b7f5801de10ae4873ca654958009
SHA256

93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5
SHA512

bdbe4590761ac379980571458a71f9c9cf0133718ce00d7aa78fe8ca4f66344ae409808c764d1eb7e65bab9f4950d7bbc574cdcf2486be10feaafa95489ed726
SSDEEP

12288:HaHLlfxMEiWtZjRHUCwRwqYCQiURT+NEbQdf3id:QhpMEVZ4LXURYF

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.mct2.co.za
Port:
587
Username:
[email protected]
Password:
00000

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2480-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

83 checkip.dyndns.org

flow	ioc
83	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

description	pid	process	target process
PID 2876 set thread context of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

pid	process
2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
2480	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

description	pid	process
Token: SeDebugPrivilege	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
Token: SeDebugPrivilege	2480	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

description	pid	process	target process
PID 2876 wrote to memory of 3888	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 3888	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 3888	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
PID 2876 wrote to memory of 2480	2876	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe	93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe

C:\Users\Admin\AppData\Local\Temp\93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
"C:\Users\Admin\AppData\Local\Temp\93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
"C:\Users\Admin\AppData\Local\Temp\93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe"
2⤵
PID:3888

C:\Users\Admin\AppData\Local\Temp\93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe
"C:\Users\Admin\AppData\Local\Temp\93da5b68246f2c37789b4fe137f570a7eaf939810bedac23fc6ce070a19672e5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-17-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/2480-15-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/2480-13-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/2876-4-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/2876-5-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/2876-6-0x0000000005D00000-0x0000000005D0A000-memory.dmp

Filesize
40KB

Download
memory/2876-7-0x0000000005DF0000-0x0000000005E06000-memory.dmp

Filesize
88KB

Download
memory/2876-8-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/2876-9-0x0000000005E00000-0x0000000005E0A000-memory.dmp

Filesize
40KB

Download
memory/2876-10-0x0000000006D20000-0x0000000006D7E000-memory.dmp

Filesize
376KB

Download
memory/2876-11-0x00000000082A0000-0x000000000833C000-memory.dmp

Filesize
624KB

Download
memory/2876-0-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/2876-3-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/2876-2-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/2876-16-0x00000000748D0000-0x0000000075080000-memory.dmp

Filesize
7.7MB

Download
memory/2876-1-0x0000000000E50000-0x0000000000EEA000-memory.dmp

Filesize
616KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads