snakekeylogger | 6e47024e23846e53598fe383b22a61d66060d95013c57103763d1f923ef6a505

General

Target

10a3c3a3c388b4bde384068720dca0e0.exe
Size

316KB
MD5

10a3c3a3c388b4bde384068720dca0e0
SHA1

cdcfa097331476d5ee6e713923ac69bbe0f8448e
SHA256

6e47024e23846e53598fe383b22a61d66060d95013c57103763d1f923ef6a505
SHA512

c9b9d9e315867ffa3e7d6a7c88affa2fd16f9cb505b1b5bde0571f46952776d6932ae7474dd5d04a7b4e485e06c1dde7748ab6768e5e50a4635a307fa07fcac0
SSDEEP

6144:b8LxBqe6xl4nMSMntPbrmFhhDaNoM4T9ifQSJEhN60wXfICL6k+4Nxx:nZxlsMiFhWFQ9iJPxXfI9EF

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1903200344:AAFlSm8e6hlfnObZcgLQazPYhmg0jo7ubTI/sendMessage?chat_id=1988673175

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2340-9-0x0000000000400000-0x000000000044B000-memory.dmp	family_snakekeylogger
behavioral1/memory/2340-12-0x0000000000400000-0x000000000044B000-memory.dmp	family_snakekeylogger
behavioral1/memory/2340-13-0x0000000000400000-0x000000000044B000-memory.dmp	family_snakekeylogger
behavioral1/memory/2340-14-0x0000000002040000-0x0000000002066000-memory.dmp	family_snakekeylogger

Loads dropped DLL 1 IoCs

Processes:

10a3c3a3c388b4bde384068720dca0e0.exe

pid process

1740 10a3c3a3c388b4bde384068720dca0e0.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
4 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

10a3c3a3c388b4bde384068720dca0e0.exe

description pid process target process

PID 1740 set thread context of 2340 1740 10a3c3a3c388b4bde384068720dca0e0.exe 10a3c3a3c388b4bde384068720dca0e0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2976 2340 WerFault.exe 10a3c3a3c388b4bde384068720dca0e0.exe

pid	process
1740	10a3c3a3c388b4bde384068720dca0e0.exe

flow	ioc
8	freegeoip.app
9	freegeoip.app
4	checkip.dyndns.org

description	pid	process	target process
PID 1740 set thread context of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe

pid	pid_target	process	target process
2976	2340	WerFault.exe	10a3c3a3c388b4bde384068720dca0e0.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

10a3c3a3c388b4bde384068720dca0e0.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	10a3c3a3c388b4bde384068720dca0e0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	10a3c3a3c388b4bde384068720dca0e0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e210f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	10a3c3a3c388b4bde384068720dca0e0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	10a3c3a3c388b4bde384068720dca0e0.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

10a3c3a3c388b4bde384068720dca0e0.exe

pid process

2340 10a3c3a3c388b4bde384068720dca0e0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

10a3c3a3c388b4bde384068720dca0e0.exe

description pid process

Token: SeDebugPrivilege 2340 10a3c3a3c388b4bde384068720dca0e0.exe

pid	process
2340	10a3c3a3c388b4bde384068720dca0e0.exe

description	pid	process
Token: SeDebugPrivilege	2340	10a3c3a3c388b4bde384068720dca0e0.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

10a3c3a3c388b4bde384068720dca0e0.exe10a3c3a3c388b4bde384068720dca0e0.exe

C:\Users\Admin\AppData\Local\Temp\10a3c3a3c388b4bde384068720dca0e0.exe
"C:\Users\Admin\AppData\Local\Temp\10a3c3a3c388b4bde384068720dca0e0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\10a3c3a3c388b4bde384068720dca0e0.exe
"C:\Users\Admin\AppData\Local\Temp\10a3c3a3c388b4bde384068720dca0e0.exe"
2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 996
3⤵
- Program crash
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso781.tmp\zlqkm.dll

Filesize
18KB

MD5
43a62bb7d67b65103a5fcc25d678834d

SHA1
d3af59ccf36ee376d80a0d9cb451780bb4f06409

SHA256
0d3a834b434f21f9d93da2dca5a9cdb14ee8301bd186b078b9734c09a92fdb4d

SHA512
a7bfbc4bfaa238add5f4985ec89c93b3324a9477cf77851c9f4ec0794693df2b0b654dc92ba38aa35e743a4ecc892290549d8e21b2f194905a06823d7c4e3e62

Download Submit
memory/1740-7-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1740-11-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2340-9-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2340-12-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2340-13-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2340-14-0x0000000002040000-0x0000000002066000-memory.dmp

Filesize
152KB

Download
memory/2340-15-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download
memory/2340-16-0x0000000004560000-0x00000000045A0000-memory.dmp

Filesize
256KB

Download
memory/2340-32-0x0000000073D60000-0x000000007444E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 1740 wrote to memory of 2340	1740	10a3c3a3c388b4bde384068720dca0e0.exe	10a3c3a3c388b4bde384068720dca0e0.exe
PID 2340 wrote to memory of 2976	2340	10a3c3a3c388b4bde384068720dca0e0.exe	WerFault.exe
PID 2340 wrote to memory of 2976	2340	10a3c3a3c388b4bde384068720dca0e0.exe	WerFault.exe
PID 2340 wrote to memory of 2976	2340	10a3c3a3c388b4bde384068720dca0e0.exe	WerFault.exe
PID 2340 wrote to memory of 2976	2340	10a3c3a3c388b4bde384068720dca0e0.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads