snakekeylogger | 3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692

General

Target

3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
Size

578KB
MD5

e774b25a7a8751c5725ed2ba1dede243
SHA1

71e7a04a9d9448d2da4c353642829edcc8fdcb67
SHA256

3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692
SHA512

8d825a39760d2792b2b0a0403f781963167642e936e4b857c2c34144fe8c16b4b6fd7abb0c83c89999af5652c73151d39b9c45327fb75ffde866dc0f41aa5908
SSDEEP

12288:Tjqcopox437NBg4OChLjFg/r8tn2FLXNFT3xOg8cqWdE:Ze3Hg43hLBio2FLXNB3xOgQoE

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3056-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3056-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3056-14-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3056-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/3056-16-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

description	pid	process	target process
PID 3052 set thread context of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

pid process

3056 3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

description pid process

Token: SeDebugPrivilege 3056 3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

pid	process
3056	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

description	pid	process
Token: SeDebugPrivilege	3056	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

description	pid	process	target process
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
PID 3052 wrote to memory of 3056	3052	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe	3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe

C:\Users\Admin\AppData\Local\Temp\3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
"C:\Users\Admin\AppData\Local\Temp\3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe
"C:\Users\Admin\AppData\Local\Temp\3087ad6676cc9169389d5dcbe9328099c9fb386a8e2c0ebaf2eae4c92924e692.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3052-0-0x0000000001110000-0x00000000011A6000-memory.dmp

Filesize
600KB

Download
memory/3052-1-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/3052-2-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/3052-3-0x0000000000340000-0x0000000000358000-memory.dmp

Filesize
96KB

Download
memory/3052-4-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3052-5-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/3052-6-0x0000000000FE0000-0x0000000001040000-memory.dmp

Filesize
384KB

Download
memory/3052-7-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/3052-19-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3056-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3056-20-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-21-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/3056-22-0x0000000074D60000-0x000000007544E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-23-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads