snakekeylogger | e984ac49945dcc020a0019a071e0dc28ce80cc0d0047b9933c096cc2217f23b1

General

Target

d9167b13f4f747f5e9b18a6688a7064e.exe
Size

647KB
MD5

d9167b13f4f747f5e9b18a6688a7064e
SHA1

a6d4fe1e243c044ebdd87b87112455425cb0ef80
SHA256

e984ac49945dcc020a0019a071e0dc28ce80cc0d0047b9933c096cc2217f23b1
SHA512

4967510c7a4c2363a29b93fab7e0e3c89cbf157c3ff1547a7febfb87cd514c143c166af9690f565642e52c6ce48c2e7732edc87545290832e4337dfa1043b4cb
SSDEEP

6144:zxqsTbYPmKymjG8cea76pONLNSHtS/dntqBekMevgqAvHe:9qmbEm9my8L06pE8atqBekVvp

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.simgeasansor.com.tr
Port:
587
Username:
[email protected]
Password:
C#2epm94
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/1964-20-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-22-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-14-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-12-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1964-27-0x0000000004900000-0x0000000004940000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	1964	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1964	d9167b13f4f747f5e9b18a6688a7064e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	d9167b13f4f747f5e9b18a6688a7064e.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 2704 wrote to memory of 1964	2704	d9167b13f4f747f5e9b18a6688a7064e.exe	29
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	30
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	30
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	30
PID 1964 wrote to memory of 2928	1964	d9167b13f4f747f5e9b18a6688a7064e.exe	30

C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe
"C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe
  "C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 1520
    3⤵
    - Program crash
    PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-27-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/1964-26-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-23-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-22-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1964-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1964-25-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/2704-6-0x0000000004970000-0x00000000049CC000-memory.dmp

Filesize
368KB

Download
memory/2704-24-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-0-0x0000000000C10000-0x0000000000CB8000-memory.dmp

Filesize
672KB

Download
memory/2704-7-0x0000000004290000-0x00000000042BE000-memory.dmp

Filesize
184KB

Download
memory/2704-5-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download
memory/2704-4-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-3-0x00000000009B0000-0x00000000009CC000-memory.dmp

Filesize
112KB

Download
memory/2704-2-0x0000000004930000-0x0000000004970000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing