snakekeylogger | 126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db

General

Target

126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
Size

577KB
MD5

009a10fd65c1d1a0381878eed34e0788
SHA1

b955284c838741c89f96bdc40b0f5d06ff7106ce
SHA256

126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db
SHA512

eff107b6c3f1e6e04114473186c5312252c375cda59dc30e3fa757d755c91abc90d5e16c91bc3d1c8b652744fa08cab4054a922ef020bd5253e1a4b9f9a61e78
SSDEEP

12288:f6copox4KSdWdblH9xrN+IW2+iaYke6G:pe5d+bl9hN+CBN1

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2672-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-19-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-21-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-23-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-26-0x00000000021E0000-0x0000000002220000-memory.dmp	family_snakekeylogger
behavioral1/memory/2672-28-0x00000000021E0000-0x0000000002220000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

description	pid	process	target process
PID 1932 set thread context of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2596 2672 WerFault.exe 126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

pid	pid_target	process	target process
2596	2672	WerFault.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

pid	process
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
2672	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

description	pid	process
Token: SeDebugPrivilege	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
Token: SeDebugPrivilege	2672	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe

description	pid	process	target process
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 1932 wrote to memory of 2672	1932	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
PID 2672 wrote to memory of 2596	2672	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	WerFault.exe
PID 2672 wrote to memory of 2596	2672	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	WerFault.exe
PID 2672 wrote to memory of 2596	2672	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	WerFault.exe
PID 2672 wrote to memory of 2596	2672	126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
"C:\Users\Admin\AppData\Local\Temp\126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe
"C:\Users\Admin\AppData\Local\Temp\126f126044e4b0e1c30955f9ec9f1f7a72956af7ff274e7533575e11e78272db.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 972
3⤵
- Program crash
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-1-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/1932-0-0x0000000000CF0000-0x0000000000D86000-memory.dmp

Filesize
600KB

Download
memory/1932-2-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/1932-3-0x0000000000920000-0x0000000000938000-memory.dmp

Filesize
96KB

Download
memory/1932-4-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/1932-5-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/1932-6-0x00000000004E0000-0x0000000000540000-memory.dmp

Filesize
384KB

Download
memory/1932-7-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/1932-8-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/1932-24-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/2672-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2672-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-21-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-23-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-25-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/2672-26-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/2672-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2672-27-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/2672-28-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads