snakekeylogger | 1b6a616fb4268be42e450d33cd8114f455a8240a8c8f61806ea935e42c4115d4

General

Target

38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe
Size

525KB
MD5

ed3cdb090dd5f8394b1fa75b32cc47f8
SHA1

27bade0fdd724dab1e067f32bbe067671d524593
SHA256

38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f
SHA512

bc85516a08278bde27685acff70ee19cdc7e6732ef8c958253fa0b7986e364a4e2a85f7ee930061774a96491ec2628d7bba16a08e7527d57f7b5455e062b81eb
SSDEEP

12288:/VMRs+xI2TjJDDbrpsLCqxa7T4l09xHY:/KRz3NC+Ul09

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

resource	yara_rule
behavioral1/memory/2176-21-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2176-23-0x0000000004990000-0x00000000049D0000-memory.dmp	family_snakekeylogger
behavioral1/memory/2176-18-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2176-14-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2176-12-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2176-8-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2176-7-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28
PID 2936 wrote to memory of 2176	2936	38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe	28

C:\Users\Admin\AppData\Local\Temp\38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe
"C:\Users\Admin\AppData\Local\Temp\38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe
  "C:\Users\Admin\AppData\Local\Temp\38964e523cea48bc329bfd1a74a818b43162f6962ca21c6ef012b716c6df467f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2176-8-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-39-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/2176-14-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-38-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-21-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-22-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-23-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/2176-5-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-6-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-7-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-12-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2176-18-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2936-0-0x00000000001E0000-0x000000000026A000-memory.dmp

Filesize
552KB

Download
memory/2936-2-0x0000000001F80000-0x0000000001FD4000-memory.dmp

Filesize
336KB

Download
memory/2936-13-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2936-1-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2936-4-0x00000000005D0000-0x00000000005D8000-memory.dmp

Filesize
32KB

Download
memory/2936-3-0x0000000000680000-0x00000000006C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing