snakekeylogger | 5f8fc87ce2f6345fcf0e10c64be58db5a907c0acd393140387e2da2dc39f3551

General

Target

d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
Size

464KB
MD5

1f7ac06f56077381b5097cde5c4cab87
SHA1

5738220c5460de988a1b30a3a9532fd226d9d3b8
SHA256

d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb
SHA512

2426d1466ec06f3e67e3fdf7f01eb79cc11e46711e955e73a28d43dc5452881bfbd62d189c082d6b6224b58ab9f51a723d58688883c61ee7703cfcfeed0f2f3f
SSDEEP

12288:vCXFQTAajA6n1tiGSZ4EidlIw8mfcMAAAAAAAAAAMA5AAAAAAAAAAAAAAAAAAAAP:vqFQTAajA4fo4EiIw8ccMAAAAAAAAAAd

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
instalacionestasende.com
Port:
25
Username:
[email protected]
Password:
VzX79@6v
Email To:
[email protected]

C2

https://scratchdreams.tk

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/796-9-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-11-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-18-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-16-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-22-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-25-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-27-0x0000000004AD0000-0x0000000004B10000-memory.dmp	family_snakekeylogger
behavioral1/memory/796-29-0x0000000004AD0000-0x0000000004B10000-memory.dmp	family_snakekeylogger

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2900 cmd.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

pid	process
2900	cmd.exe

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

description	pid	process	target process
PID 1196 set thread context of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

pid process

796 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

description pid process

Token: SeDebugPrivilege 796 d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

pid	process
796	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

description	pid	process
Token: SeDebugPrivilege	796	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exed3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.execmd.exe

description	pid	process	target process
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 1196 wrote to memory of 796	1196	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
PID 796 wrote to memory of 2900	796	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	cmd.exe
PID 796 wrote to memory of 2900	796	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	cmd.exe
PID 796 wrote to memory of 2900	796	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	cmd.exe
PID 796 wrote to memory of 2900	796	d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe	cmd.exe
PID 2900 wrote to memory of 2044	2900	cmd.exe	choice.exe
PID 2900 wrote to memory of 2044	2900	cmd.exe	choice.exe
PID 2900 wrote to memory of 2044	2900	cmd.exe	choice.exe
PID 2900 wrote to memory of 2044	2900	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
"C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
  "C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-26-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/796-28-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/796-11-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-29-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/796-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/796-5-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-7-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-27-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/796-30-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/796-25-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-9-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-18-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-16-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/796-22-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/1196-1-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1196-0-0x0000000000320000-0x000000000039A000-memory.dmp

Filesize
488KB

Download
memory/1196-17-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1196-4-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/1196-3-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/1196-2-0x00000000005A0000-0x00000000005F6000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads