snakekeylogger | 9a3cccbf3ec54e526e6979adac8e32294a092ad0374ed8254bebbe525c63551a

General

Target

cb64dddceb29c15b7c0b1c346b0c81ed.exe
Size

833KB
MD5

cb64dddceb29c15b7c0b1c346b0c81ed
SHA1

9778d888d49c13dd3ce071ed60dbd20d5859eb51
SHA256

9a3cccbf3ec54e526e6979adac8e32294a092ad0374ed8254bebbe525c63551a
SHA512

e539b2e0e9b4d09d304ff334cd5c081a8509571dfc47ed57b9df7c8806de14b8f2c3dc7c345552874d3fd60066ad3e76834d28f62568cd623876fa46d139e9bf
SSDEEP

12288:6stYdODLqJmNuoLUzJtd6f7G+ubJT7rarB/oGrr6zJelbefCIx:6stY4PTUWfXuN/yxmzAbefCIx

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
alexfoxfreight.com
Port:
587
Username:
[email protected]
Password:
Ueos*93sj!#!12
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/2640-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2640-12-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2640-16-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2640-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2640-20-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2640-23-0x0000000000670000-0x00000000006B0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2432	2640	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe
2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe
2640	cb64dddceb29c15b7c0b1c346b0c81ed.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe
Token: SeDebugPrivilege	2640	cb64dddceb29c15b7c0b1c346b0c81ed.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2588	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	30
PID 2008 wrote to memory of 2588	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	30
PID 2008 wrote to memory of 2588	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	30
PID 2008 wrote to memory of 2588	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	30
PID 2008 wrote to memory of 2604	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	31
PID 2008 wrote to memory of 2604	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	31
PID 2008 wrote to memory of 2604	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	31
PID 2008 wrote to memory of 2604	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	31
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2008 wrote to memory of 2640	2008	cb64dddceb29c15b7c0b1c346b0c81ed.exe	32
PID 2640 wrote to memory of 2432	2640	cb64dddceb29c15b7c0b1c346b0c81ed.exe	33
PID 2640 wrote to memory of 2432	2640	cb64dddceb29c15b7c0b1c346b0c81ed.exe	33
PID 2640 wrote to memory of 2432	2640	cb64dddceb29c15b7c0b1c346b0c81ed.exe	33
PID 2640 wrote to memory of 2432	2640	cb64dddceb29c15b7c0b1c346b0c81ed.exe	33

C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe
"C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe
  "C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe"
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe
  "C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe
  "C:\Users\Admin\AppData\Local\Temp\cb64dddceb29c15b7c0b1c346b0c81ed.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1620
    3⤵
    - Program crash
    PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x00000000001D0000-0x00000000002A6000-memory.dmp

Filesize
856KB

Download
memory/2008-1-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-2-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2008-3-0x0000000000570000-0x000000000058A000-memory.dmp

Filesize
104KB

Download
memory/2008-4-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2008-5-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/2008-6-0x0000000006040000-0x00000000060D4000-memory.dmp

Filesize
592KB

Download
memory/2008-7-0x00000000041C0000-0x00000000041E6000-memory.dmp

Filesize
152KB

Download
memory/2008-21-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2640-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-20-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2640-22-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-23-0x0000000000670000-0x00000000006B0000-memory.dmp

Filesize
256KB

Download
memory/2640-24-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-25-0x0000000000670000-0x00000000006B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing