snakekeylogger | 9c3c75f3073c8a3aa8557fb4f1797ff3dded28fead9787620919526efb2fb060

General

Target

SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe
Size

555KB
MD5

e8a284395efbc80745f8610494df4b18
SHA1

98ae45686c0e220320d76a6d53f15c616a4c5af4
SHA256

9c3c75f3073c8a3aa8557fb4f1797ff3dded28fead9787620919526efb2fb060
SHA512

89023473dd712f49f23d3e345c9f0c86108b13a40d4e29f20c10aec710ebdabe78818b7df7a06f434ff7cf255e6db9580c17b1ed3a566d4e4e41bb247c9fc963
SSDEEP

12288:lykTxOO+4WpAEuy7Q9oWupl0dj8I2DS1XWKNIOBjJILJBHEpsfYWsK3UiV6/+:+pAETll0dmbCbs07WDT6

Score

10^/10

snakekeylogger zgrat keylogger rat stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2544-3-0x0000000000480000-0x0000000000498000-memory.dmp	family_zgrat_v1

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2816-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2816-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2816-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2816-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2816-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe

description pid process target process

PID 2544 set thread context of 2816 2544 SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 2816 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegSvcs.exe

pid process

2816 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2816 RegSvcs.exe

flow	ioc
2	checkip.dyndns.org

description	pid	process	target process
PID 2544 set thread context of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe

pid	pid_target	process	target process
2672	2816	WerFault.exe	RegSvcs.exe

pid	process
2816	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2816	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exeRegSvcs.exe

description	pid	process	target process
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2544 wrote to memory of 2816	2544	SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe	RegSvcs.exe
PID 2816 wrote to memory of 2672	2816	RegSvcs.exe	WerFault.exe
PID 2816 wrote to memory of 2672	2816	RegSvcs.exe	WerFault.exe
PID 2816 wrote to memory of 2672	2816	RegSvcs.exe	WerFault.exe
PID 2816 wrote to memory of 2672	2816	RegSvcs.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.29210.19083.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 944
3⤵
- Program crash
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-0-0x0000000000F60000-0x0000000000FF0000-memory.dmp

Filesize
576KB

Download
memory/2544-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2544-2-0x0000000000EA0000-0x0000000000EE0000-memory.dmp

Filesize
256KB

Download
memory/2544-3-0x0000000000480000-0x0000000000498000-memory.dmp

Filesize
96KB

Download
memory/2544-4-0x0000000000410000-0x0000000000418000-memory.dmp

Filesize
32KB

Download
memory/2544-5-0x0000000000990000-0x000000000099A000-memory.dmp

Filesize
40KB

Download
memory/2544-6-0x0000000000AA0000-0x0000000000B00000-memory.dmp

Filesize
384KB

Download
memory/2544-18-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2816-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2816-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2816-19-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2816-20-0x0000000004BC0000-0x0000000004C00000-memory.dmp

Filesize
256KB

Download
memory/2816-21-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads