snakekeylogger | 67051497fd97c6af464c672d930bc0e03f49fec42759bd94e1d5b7c3cf34e7bb

General

Target

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe
Size

772KB
MD5

0390281aa6bea2fccb424eec15cc7e78
SHA1

cbbe6381a0292f69bab951edd849fb713d4f76b2
SHA256

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
SHA512

7f23783f6b54551ae0779012031b9d595b14dffc80a11274c43011606d80c86063513d00e1503853e4353e2249c36a886c6f12cbbfe032e334d152d979a2bc24
SSDEEP

12288:dJpHCmbiNIwPt2gBpD1tM2MH6YZLuKw3WDJV733EgpAUBXvlL/bD9x7DW:ZCFPtBpD1tM2MTZLE6/l

Score

10^/10

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-16-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1992-14-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1992-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1992-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1992-7-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe

description	pid	process	target process
PID 1620 set thread context of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

1992 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 1992 RegAsm.exe

pid	process
1992	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1992	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe

description	pid	process	target process
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 1620 wrote to memory of 1992	1620	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe

memory/1620-13-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/1620-1-0x0000000074170000-0x000000007485E000-memory.dmp

Filesize
6.9MB

Download
memory/1620-3-0x00000000004E0000-0x0000000000520000-memory.dmp

Filesize
256KB

Download
memory/1620-2-0x0000000000490000-0x00000000004E4000-memory.dmp

Filesize
336KB

Download
memory/1620-4-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/1620-0-0x0000000000F90000-0x0000000001056000-memory.dmp

Filesize
792KB

Download
memory/1992-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1992-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1992-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1992-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1992-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1992-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1992-5-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1992-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download