snakekeylogger | 8c5308faa016ec4a047a72c04fccdd6e49cece16947fc000491d947d102fdd45

General

Target

3a439e3638fe4b48f0b76f6844c6e9a3.exe
Size

580KB
MD5

3a439e3638fe4b48f0b76f6844c6e9a3
SHA1

6c45d83f3d62cbd7af2bbf0e72aa134a6cc1509d
SHA256

8c5308faa016ec4a047a72c04fccdd6e49cece16947fc000491d947d102fdd45
SHA512

865dcafd88a016117eb6817f338058e5a6e55b3db1ebbe1e9b21f4a9c4cd9a9347e684f4458cd10490c83a76a1bedd27ffbf6c9fd2ae4b8e917afc4ec20f2051
SSDEEP

12288:3Ee9XyLSWv0NP2sg4hiBrv2Sq0WuknrhbptL3ekqjn4Or6X20:Ss1pxSkbH

Score

10^/10

snakekeylogger zgrat keylogger rat stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
m$ExnQx8
Email To:
[email protected]

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/824-4-0x0000000000330000-0x0000000000346000-memory.dmp	family_zgrat_v1

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1636-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1636-18-0x0000000004700000-0x0000000004740000-memory.dmp	family_snakekeylogger
behavioral1/memory/1636-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1636-11-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1636-8-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/1636-7-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

description pid process target process

PID 824 set thread context of 1636 824 3a439e3638fe4b48f0b76f6844c6e9a3.exe 3a439e3638fe4b48f0b76f6844c6e9a3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2684 1636 WerFault.exe 3a439e3638fe4b48f0b76f6844c6e9a3.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

pid process

1636 3a439e3638fe4b48f0b76f6844c6e9a3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

description pid process

Token: SeDebugPrivilege 1636 3a439e3638fe4b48f0b76f6844c6e9a3.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

description	pid	process	target process
PID 824 set thread context of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe

pid	pid_target	process	target process
2684	1636	WerFault.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe

pid	process
1636	3a439e3638fe4b48f0b76f6844c6e9a3.exe

description	pid	process
Token: SeDebugPrivilege	1636	3a439e3638fe4b48f0b76f6844c6e9a3.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

description	pid	process	target process
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 824 wrote to memory of 1636	824	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe

C:\Users\Admin\AppData\Local\Temp\3a439e3638fe4b48f0b76f6844c6e9a3.exe
"C:\Users\Admin\AppData\Local\Temp\3a439e3638fe4b48f0b76f6844c6e9a3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Local\Temp\3a439e3638fe4b48f0b76f6844c6e9a3.exe
"C:\Users\Admin\AppData\Local\Temp\3a439e3638fe4b48f0b76f6844c6e9a3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 700
3⤵
- Program crash
PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-14-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/824-2-0x0000000000C30000-0x0000000000C70000-memory.dmp

Filesize
256KB

Download
memory/824-0-0x0000000001080000-0x0000000001118000-memory.dmp

Filesize
608KB

Download
memory/824-3-0x0000000000480000-0x00000000004BE000-memory.dmp

Filesize
248KB

Download
memory/824-4-0x0000000000330000-0x0000000000346000-memory.dmp

Filesize
88KB

Download
memory/824-1-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/1636-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1636-17-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/1636-34-0x0000000004700000-0x0000000004740000-memory.dmp

Filesize
256KB

Download
memory/1636-18-0x0000000004700000-0x0000000004740000-memory.dmp

Filesize
256KB

Download
memory/1636-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1636-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1636-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1636-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1636-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1636-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1636-33-0x0000000074DF0000-0x00000000754DE000-memory.dmp

Filesize
6.9MB

Download
memory/1636-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads