snakekeylogger | 1aa71ccdef644e05966553af027e6434454c8e76a1e04522a7ad2da789d8f248

General

Target

334c0820434d474ffc6d7347f8c27697.exe
Size

574KB
MD5

334c0820434d474ffc6d7347f8c27697
SHA1

f0af5e6bb35f3b10f26386f4ad77db78ed0b4a72
SHA256

1aa71ccdef644e05966553af027e6434454c8e76a1e04522a7ad2da789d8f248
SHA512

8deaec055e232565d30de462082245d1d4967de1777e4d22d8969a017022da2479af029e37674c4a31d6aee1961e9b00f69808c6cf0d7a0f150a474ee2ff5d64
SSDEEP

12288:WapTqZxyRlYoeibexh9mu+02dG0cMBxo/c7mo5oFCEkv:WiTqfyRuoFbC8j0sG0J7mo5oFCEkv

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.ademkocplastik.com.tr
Port:
587
Username:
[email protected]
Password:
Ad1.iqwerty?_
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3320-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/4488-7-0x0000000004A30000-0x0000000004A42000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 freegeoip.app
39 checkip.dyndns.org
41 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

334c0820434d474ffc6d7347f8c27697.exe

description pid process target process

PID 4488 set thread context of 3320 4488 334c0820434d474ffc6d7347f8c27697.exe 334c0820434d474ffc6d7347f8c27697.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4024 3320 WerFault.exe 334c0820434d474ffc6d7347f8c27697.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

334c0820434d474ffc6d7347f8c27697.exe

pid process

3320 334c0820434d474ffc6d7347f8c27697.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

334c0820434d474ffc6d7347f8c27697.exe

description pid process

Token: SeDebugPrivilege 3320 334c0820434d474ffc6d7347f8c27697.exe

flow	ioc
43	freegeoip.app
39	checkip.dyndns.org
41	freegeoip.app

description	pid	process	target process
PID 4488 set thread context of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe

pid	pid_target	process	target process
4024	3320	WerFault.exe	334c0820434d474ffc6d7347f8c27697.exe

pid	process
3320	334c0820434d474ffc6d7347f8c27697.exe

description	pid	process
Token: SeDebugPrivilege	3320	334c0820434d474ffc6d7347f8c27697.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

334c0820434d474ffc6d7347f8c27697.exe

description	pid	process	target process
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe
PID 4488 wrote to memory of 3320	4488	334c0820434d474ffc6d7347f8c27697.exe	334c0820434d474ffc6d7347f8c27697.exe

C:\Users\Admin\AppData\Local\Temp\334c0820434d474ffc6d7347f8c27697.exe
"C:\Users\Admin\AppData\Local\Temp\334c0820434d474ffc6d7347f8c27697.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4488

C:\Users\Admin\AppData\Local\Temp\334c0820434d474ffc6d7347f8c27697.exe
"C:\Users\Admin\AppData\Local\Temp\334c0820434d474ffc6d7347f8c27697.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 1780
3⤵
- Program crash
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3320 -ip 3320
1⤵
PID:2444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\334c0820434d474ffc6d7347f8c27697.exe.log

Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
memory/3320-18-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/3320-17-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3320-15-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/3320-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4488-5-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/4488-3-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/4488-7-0x0000000004A30000-0x0000000004A42000-memory.dmp

Filesize
72KB

Download
memory/4488-8-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4488-9-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/4488-10-0x0000000006920000-0x0000000006992000-memory.dmp

Filesize
456KB

Download
memory/4488-6-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/4488-0-0x00000000006D0000-0x0000000000766000-memory.dmp

Filesize
600KB

Download
memory/4488-16-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4488-4-0x00000000050D0000-0x000000000516C000-memory.dmp

Filesize
624KB

Download
memory/4488-11-0x0000000006AA0000-0x0000000006ACA000-memory.dmp

Filesize
168KB

Download
memory/4488-1-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4488-2-0x00000000055E0000-0x0000000005B84000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads