snakekeylogger | 185b0943e47ff2499a805f751a20dfd58ef018e9e20f170a51cfd9d009992803

General

Target

229fc8af13dd6426cdd18ff1b3ca4198.exe
Size

642KB
MD5

229fc8af13dd6426cdd18ff1b3ca4198
SHA1

777a6477ce223ee70348d28c1a789d29b8a6d1f0
SHA256

185b0943e47ff2499a805f751a20dfd58ef018e9e20f170a51cfd9d009992803
SHA512

506be426584f0b84e99af15f01f1afce204f0525cc5db9fe0714c424ad391cf0d764649e0e82a2e549465c7cc8ef8586dca1553b40cd6345bd05aa449a6da734
SSDEEP

12288:cp0tkaHe+/8gGVNgEeTCy+5y4/QhNDtFwI1CP3snobfYG8/jSueTZiWNMIuWbyS:G0t1PLFwI1vnOx

Score

10^/10

snakekeylogger zgrat keylogger rat stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
lasmock001
Email To:
[email protected]

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/2656-4-0x0000000000AD0000-0x0000000000AE6000-memory.dmp	family_zgrat_v1

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

resource	yara_rule
behavioral1/memory/1884-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1884-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1884-20-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1884-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1884-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	freegeoip.app
2	checkip.dyndns.org
4	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2656 set thread context of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	1884	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1884	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 2656 wrote to memory of 1884	2656	229fc8af13dd6426cdd18ff1b3ca4198.exe	28
PID 1884 wrote to memory of 1072	1884	RegAsm.exe	31
PID 1884 wrote to memory of 1072	1884	RegAsm.exe	31
PID 1884 wrote to memory of 1072	1884	RegAsm.exe	31
PID 1884 wrote to memory of 1072	1884	RegAsm.exe	31

C:\Users\Admin\AppData\Local\Temp\229fc8af13dd6426cdd18ff1b3ca4198.exe
"C:\Users\Admin\AppData\Local\Temp\229fc8af13dd6426cdd18ff1b3ca4198.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1580
    3⤵
    - Program crash
    PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1884-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1884-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1884-5-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1884-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1884-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1884-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1884-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1884-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2656-1-0x0000000073E10000-0x00000000744FE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-0-0x0000000001250000-0x00000000012F6000-memory.dmp

Filesize
664KB

Download
memory/2656-19-0x0000000073E10000-0x00000000744FE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-4-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

Filesize
88KB

Download
memory/2656-3-0x0000000000A90000-0x0000000000AD0000-memory.dmp

Filesize
256KB

Download
memory/2656-2-0x0000000000B00000-0x0000000000B40000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing