snakekeylogger | 1d02b125ee09507cbc1cfb446274c5d380f8d2d43e0083f65d3341d741eb3bbf

General

Target

$PLUGINSDIR/mqpdzmdsq.dll
Size

22KB
MD5

c49786a64061cb1ec53737946be6e6b8
SHA1

23aea486baf2da29a164342abfacc42d24c4e2f7
SHA256

167ce47c8c1ffb564b0d793f556fa109eb17ab54846e0a5cb79efee53f0a471a
SHA512

1d2c0d8243faa8783b73150ddd50aec38c32f980a9d6fd9311495a3c531fbb668b0a74e9c3fc82059ec7a8a9b09cee82c2870b93105f2ac1661eb1e1ef3d3406
SSDEEP

192:MniBZI5F6cnX8blqLJRYad+Mj1uvfY0WGZkzLuFqbsk/HxZT9TOBkjtDJoZMcxR4:MnM9lcY546kzLuFMHJOgtDJgnMS9lxW

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 4 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1820-2-0x0000000000400000-0x0000000000457000-memory.dmp	family_snakekeylogger
behavioral3/memory/1820-4-0x0000000000400000-0x0000000000457000-memory.dmp	family_snakekeylogger
behavioral3/memory/1820-6-0x0000000000400000-0x0000000000457000-memory.dmp	family_snakekeylogger
behavioral3/memory/1820-14-0x0000000000510000-0x0000000000550000-memory.dmp	family_snakekeylogger

Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

5 1820 rundll32.exe
7 1820 rundll32.exe
9 1820 rundll32.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
6 freegeoip.app
7 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 2384 set thread context of 1820 2384 rundll32.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1820 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1820 rundll32.exe

flow	pid	process
5	1820	rundll32.exe
7	1820	rundll32.exe
9	1820	rundll32.exe

flow	ioc
4	checkip.dyndns.org
6	freegeoip.app
7	freegeoip.app

description	pid	process	target process
PID 2384 set thread context of 1820	2384	rundll32.exe	rundll32.exe

pid	process
1820	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1820	rundll32.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 1052 wrote to memory of 2384	1052	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 2384 wrote to memory of 1820	2384	rundll32.exe	rundll32.exe
PID 1820 wrote to memory of 1268	1820	rundll32.exe	dw20.exe
PID 1820 wrote to memory of 1268	1820	rundll32.exe	dw20.exe
PID 1820 wrote to memory of 1268	1820	rundll32.exe	dw20.exe
PID 1820 wrote to memory of 1268	1820	rundll32.exe	dw20.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mqpdzmdsq.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mqpdzmdsq.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mqpdzmdsq.dll,#1
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 1468
      4⤵
      PID:1268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-12-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1268-18-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/1820-11-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1820-10-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1820-6-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1820-17-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1820-8-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/1820-9-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/1820-16-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1820-4-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1820-2-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1820-13-0x0000000074B30000-0x00000000750DB000-memory.dmp

Filesize
5.7MB

Download
memory/1820-14-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/1820-15-0x0000000000510000-0x0000000000550000-memory.dmp

Filesize
256KB

Download
memory/2384-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2384-7-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2384-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads