snakekeylogger | 7bb173d6f12fefce48a6a3f2ec2d2e73bab1a1fc3c7a8f1fed35694a4053953f

General

Target

49d00fbb783d0a1f50039699bb9e0e3a.exe
Size

600KB
MD5

49d00fbb783d0a1f50039699bb9e0e3a
SHA1

d37b84415b0619497c7786e6d1db1883c071e0d3
SHA256

7bb173d6f12fefce48a6a3f2ec2d2e73bab1a1fc3c7a8f1fed35694a4053953f
SHA512

1b4a3cb9a632a4c91600f700a829f107608bffae26a1457fee8595bb74e3c7506586c607975b2802709a297af918c880b6c762ca1d628bc20d9ef9206f194448
SSDEEP

12288:lYiPU9nPU9aOZFH0PiDRs2OsBgo0q4wMD1cGXdr6m6sD9Whu0QaxIpbj2XYpOZ:lYARs2OsBgo0q4wMDedW9+Q7p1pq

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
xMdrSUH1
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2592-26-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2592-24-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2592-22-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2592-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2592-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/840-3-0x0000000000490000-0x00000000004A2000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1076 2592 WerFault.exe 49d00fbb783d0a1f50039699bb9e0e3a.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1716 schtasks.exe

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app

pid	pid_target	process	target process
1076	2592	WerFault.exe	49d00fbb783d0a1f50039699bb9e0e3a.exe

pid	process
1716	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe
"C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe"
1⤵
PID:840

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\khPJoP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1748.tmp"
2⤵
- Creates scheduled task(s)
PID:1716

C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe
"C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe"
2⤵
PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 1520
3⤵
- Program crash
PID:1076

C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe
"C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe"
2⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe
"C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe"
2⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe
"C:\Users\Admin\AppData\Local\Temp\49d00fbb783d0a1f50039699bb9e0e3a.exe"
2⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1748.tmp

Filesize
1KB

MD5
2216f7cfd7c67077defa95011338fe86

SHA1
721514fbf17a9c84dd1043a4a4d95b52b5cbded9

SHA256
e372362ff8b31e6a4c75b8aff6a3c3cbde14cd37222edddf656fd665083744b9

SHA512
2e176ae51c82affd75010b57de63182aab7d17409c90244e0617acf8a109ee1bc5450a61cee741751f044d89ec8539502f4a4c87688fecc1568bb5dadeaa8b67

Download Submit
memory/840-0-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/840-1-0x00000000000F0000-0x000000000018C000-memory.dmp

Filesize
624KB

Download
memory/840-2-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/840-3-0x0000000000490000-0x00000000004A2000-memory.dmp

Filesize
72KB

Download
memory/840-4-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/840-5-0x0000000004D40000-0x0000000004D80000-memory.dmp

Filesize
256KB

Download
memory/840-6-0x0000000004E80000-0x0000000004EE8000-memory.dmp

Filesize
416KB

Download
memory/840-7-0x0000000000730000-0x000000000075A000-memory.dmp

Filesize
168KB

Download
memory/840-27-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2592-28-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2592-29-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download
memory/2592-26-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2592-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2592-30-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2592-31-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads