snakekeylogger | cc30cca539bada9937974d947457659f6f48d792ac83106afaa5ab3115b3013c

General

Target

193d42b40e4a666cb9da8a98394d6781.exe
Size

1.1MB
MD5

193d42b40e4a666cb9da8a98394d6781
SHA1

8ad759a2db5798b73ee9408fed45292a73d5c943
SHA256

cc30cca539bada9937974d947457659f6f48d792ac83106afaa5ab3115b3013c
SHA512

bb0ad59b2f91f3ae4ce73df07440f9f29a793467006f857177b3c9d894591357b6d9c89a70c33a5aba57b6a1a37b78a51746d6fdabbafb52f145f6b06b1b8694
SSDEEP

24576:iYIgCm+KXHOsBgo0q4wMsTBOCNil/1+uXnAIhl:iBseoHMsQOk+u3AI

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.logoffices.com
Port:
587
Username:
[email protected]
Password:
QAZqaz123@
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2552-10-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2552-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2552-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2552-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2552-20-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2552-23-0x0000000004970000-0x00000000049B0000-memory.dmp	family_snakekeylogger
behavioral1/memory/2552-25-0x0000000004970000-0x00000000049B0000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/3044-3-0x0000000000360000-0x0000000000372000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

193d42b40e4a666cb9da8a98394d6781.exe

description pid process target process

PID 3044 set thread context of 2552 3044 193d42b40e4a666cb9da8a98394d6781.exe 193d42b40e4a666cb9da8a98394d6781.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1304 2552 WerFault.exe 193d42b40e4a666cb9da8a98394d6781.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

193d42b40e4a666cb9da8a98394d6781.exe

pid process

2552 193d42b40e4a666cb9da8a98394d6781.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

193d42b40e4a666cb9da8a98394d6781.exe

description pid process

Token: SeDebugPrivilege 2552 193d42b40e4a666cb9da8a98394d6781.exe

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app

description	pid	process	target process
PID 3044 set thread context of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe

pid	pid_target	process	target process
1304	2552	WerFault.exe	193d42b40e4a666cb9da8a98394d6781.exe

pid	process
2552	193d42b40e4a666cb9da8a98394d6781.exe

description	pid	process
Token: SeDebugPrivilege	2552	193d42b40e4a666cb9da8a98394d6781.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

193d42b40e4a666cb9da8a98394d6781.exe193d42b40e4a666cb9da8a98394d6781.exe

description	pid	process	target process
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 3044 wrote to memory of 2552	3044	193d42b40e4a666cb9da8a98394d6781.exe	193d42b40e4a666cb9da8a98394d6781.exe
PID 2552 wrote to memory of 1304	2552	193d42b40e4a666cb9da8a98394d6781.exe	WerFault.exe
PID 2552 wrote to memory of 1304	2552	193d42b40e4a666cb9da8a98394d6781.exe	WerFault.exe
PID 2552 wrote to memory of 1304	2552	193d42b40e4a666cb9da8a98394d6781.exe	WerFault.exe
PID 2552 wrote to memory of 1304	2552	193d42b40e4a666cb9da8a98394d6781.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\193d42b40e4a666cb9da8a98394d6781.exe
"C:\Users\Admin\AppData\Local\Temp\193d42b40e4a666cb9da8a98394d6781.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\193d42b40e4a666cb9da8a98394d6781.exe
"C:\Users\Admin\AppData\Local\Temp\193d42b40e4a666cb9da8a98394d6781.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 1520
3⤵
- Program crash
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2552-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2552-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2552-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2552-25-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/2552-24-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2552-23-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/2552-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2552-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2552-22-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2552-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3044-4-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-3-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/3044-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-0-0x0000000000E80000-0x0000000000FA4000-memory.dmp

Filesize
1.1MB

Download
memory/3044-21-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/3044-2-0x0000000000DE0000-0x0000000000E20000-memory.dmp

Filesize
256KB

Download
memory/3044-7-0x0000000000840000-0x0000000000868000-memory.dmp

Filesize
160KB

Download
memory/3044-6-0x00000000053A0000-0x000000000540A000-memory.dmp

Filesize
424KB

Download
memory/3044-5-0x0000000000DE0000-0x0000000000E20000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads