snakekeylogger | e984ac49945dcc020a0019a071e0dc28ce80cc0d0047b9933c096cc2217f23b1

General

Target

d9167b13f4f747f5e9b18a6688a7064e.exe
Size

647KB
MD5

d9167b13f4f747f5e9b18a6688a7064e
SHA1

a6d4fe1e243c044ebdd87b87112455425cb0ef80
SHA256

e984ac49945dcc020a0019a071e0dc28ce80cc0d0047b9933c096cc2217f23b1
SHA512

4967510c7a4c2363a29b93fab7e0e3c89cbf157c3ff1547a7febfb87cd514c143c166af9690f565642e52c6ce48c2e7732edc87545290832e4337dfa1043b4cb
SSDEEP

6144:zxqsTbYPmKymjG8cea76pONLNSHtS/dntqBekMevgqAvHe:9qmbEm9my8L06pE8atqBekVvp

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.simgeasansor.com.tr
Port:
587
Username:
[email protected]
Password:
C#2epm94
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-20-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-22-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-14-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-12-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-27-0x0000000004900000-0x0000000004940000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

description pid process target process

PID 2704 set thread context of 1964 2704 d9167b13f4f747f5e9b18a6688a7064e.exe d9167b13f4f747f5e9b18a6688a7064e.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2928 1964 WerFault.exe d9167b13f4f747f5e9b18a6688a7064e.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

pid process

1964 d9167b13f4f747f5e9b18a6688a7064e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

description pid process

Token: SeDebugPrivilege 1964 d9167b13f4f747f5e9b18a6688a7064e.exe

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app

description	pid	process	target process
PID 2704 set thread context of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe

pid	pid_target	process	target process
2928	1964	WerFault.exe	d9167b13f4f747f5e9b18a6688a7064e.exe

pid	process
1964	d9167b13f4f747f5e9b18a6688a7064e.exe

description	pid	process
Token: SeDebugPrivilege	1964	d9167b13f4f747f5e9b18a6688a7064e.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exed9167b13f4f747f5e9b18a6688a7064e.exe

description	pid	process	target process
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	WerFault.exe
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	WerFault.exe
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	WerFault.exe
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe
"C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704

C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe
"C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1520
3⤵
- Program crash
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-25-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/1964-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-23-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-27-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/1964-26-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2704-6-0x0000000004970000-0x00000000049CC000-memory.dmp

Filesize
368KB

Download
memory/2704-3-0x00000000009B0000-0x00000000009CC000-memory.dmp

Filesize
112KB

Download
memory/2704-4-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-0-0x0000000000C10000-0x0000000000CB8000-memory.dmp

Filesize
672KB

Download
memory/2704-2-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2704-7-0x0000000004290000-0x00000000042BE000-memory.dmp

Filesize
184KB

Download
memory/2704-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-5-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2704-24-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing