snakekeylogger | e984ac49945dcc020a0019a071e0dc28ce80cc0d0047b9933c096cc2217f23b1

General

Target

d9167b13f4f747f5e9b18a6688a7064e.exe
Size

647KB
MD5

d9167b13f4f747f5e9b18a6688a7064e
SHA1

a6d4fe1e243c044ebdd87b87112455425cb0ef80
SHA256

e984ac49945dcc020a0019a071e0dc28ce80cc0d0047b9933c096cc2217f23b1
SHA512

4967510c7a4c2363a29b93fab7e0e3c89cbf157c3ff1547a7febfb87cd514c143c166af9690f565642e52c6ce48c2e7732edc87545290832e4337dfa1043b4cb
SSDEEP

6144:zxqsTbYPmKymjG8cea76pONLNSHtS/dntqBekMevgqAvHe:9qmbEm9my8L06pE8atqBekVvp

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.simgeasansor.com.tr
Port:
587
Username:
[email protected]
Password:
C#2epm94
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2176-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral2/memory/2176-15-0x0000000005AD0000-0x0000000005AE0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

72 checkip.dyndns.org
81 freegeoip.app
82 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

description pid process target process

PID 1156 set thread context of 2176 1156 d9167b13f4f747f5e9b18a6688a7064e.exe d9167b13f4f747f5e9b18a6688a7064e.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1868 2176 WerFault.exe d9167b13f4f747f5e9b18a6688a7064e.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

pid process

2176 d9167b13f4f747f5e9b18a6688a7064e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

description pid process

Token: SeDebugPrivilege 2176 d9167b13f4f747f5e9b18a6688a7064e.exe

flow	ioc
72	checkip.dyndns.org
81	freegeoip.app
82	freegeoip.app

description	pid	process	target process
PID 1156 set thread context of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe

pid	pid_target	process	target process
1868	2176	WerFault.exe	d9167b13f4f747f5e9b18a6688a7064e.exe

pid	process
2176	d9167b13f4f747f5e9b18a6688a7064e.exe

description	pid	process
Token: SeDebugPrivilege	2176	d9167b13f4f747f5e9b18a6688a7064e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d9167b13f4f747f5e9b18a6688a7064e.exe

description	pid	process	target process
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe
PID 1156 wrote to memory of 2176	1156	d9167b13f4f747f5e9b18a6688a7064e.exe	d9167b13f4f747f5e9b18a6688a7064e.exe

C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe
"C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe
"C:\Users\Admin\AppData\Local\Temp\d9167b13f4f747f5e9b18a6688a7064e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1124
3⤵
- Program crash
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2176 -ip 2176
1⤵
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d9167b13f4f747f5e9b18a6688a7064e.exe.log

Filesize
1KB

MD5
9c8ef6dc66746f36312b5ad4f1ad6ca0

SHA1
6e8b71e07bbeacf20e8174dd8934dcd62bf84345

SHA256
1e1581ebd843ceb83d75cbc88961cc855f663ec83ca71e48eb62f40439f54799

SHA512
255a9ea3f6c5faff3357b51399e017e3027c50aa8cde79ba796fb8632d0fa44c6228ee892f56834c0f8e5f83032a2982c3e625f03839fbf63071290c0c9b2451

Download Submit
memory/1156-8-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/1156-7-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/1156-3-0x0000000005630000-0x00000000056C2000-memory.dmp

Filesize
584KB

Download
memory/1156-4-0x0000000005590000-0x00000000055AC000-memory.dmp

Filesize
112KB

Download
memory/1156-9-0x0000000006360000-0x00000000063BC000-memory.dmp

Filesize
368KB

Download
memory/1156-5-0x0000000005C80000-0x0000000006224000-memory.dmp

Filesize
5.6MB

Download
memory/1156-2-0x00000000053F0000-0x0000000005400000-memory.dmp

Filesize
64KB

Download
memory/1156-1-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/1156-6-0x0000000005770000-0x000000000580C000-memory.dmp

Filesize
624KB

Download
memory/1156-10-0x00000000088D0000-0x00000000088FE000-memory.dmp

Filesize
184KB

Download
memory/1156-16-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/1156-0-0x0000000000A10000-0x0000000000AB8000-memory.dmp

Filesize
672KB

Download
memory/2176-14-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2176-15-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/2176-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2176-17-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads