snakekeylogger | 3fc5704b218d36edafda4e1235bd6e254b64e80938309cdbba9b5480da410911

General

Target

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe
Size

772KB
MD5

a8ef65a587aa367c3c5c9090dff4cc86
SHA1

349ac86f57b328017c9c9b478a68f610778afbeb
SHA256

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
SHA512

356e6195db849e3cb4975579243c2f707349c6444350e09d384a3279874970bb42812d8533ed7e68d2332b22359e7dc8a9a22b2a43ba5e1ba10f69b95bedac71
SSDEEP

12288:dJpHCmbiNIwP2sBpD1tM2MH6YZLuKw3WDJV733EgpAho8WAKo9mXe:ZCFP2WpD1tM2MTZLEew

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2336-7-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2336-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2336-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2336-16-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2336-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe

description	pid	process	target process
PID 1928 set thread context of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

2336 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2336 RegAsm.exe

pid	process
2336	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2336	RegAsm.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exeRegAsm.execmd.exe

description	pid	process	target process
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1928 wrote to memory of 2336	1928	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 2336 wrote to memory of 1484	2336	RegAsm.exe	cmd.exe
PID 2336 wrote to memory of 1484	2336	RegAsm.exe	cmd.exe
PID 2336 wrote to memory of 1484	2336	RegAsm.exe	cmd.exe
PID 2336 wrote to memory of 1484	2336	RegAsm.exe	cmd.exe
PID 1484 wrote to memory of 2668	1484	cmd.exe	choice.exe
PID 1484 wrote to memory of 2668	1484	cmd.exe	choice.exe
PID 1484 wrote to memory of 2668	1484	cmd.exe	choice.exe
PID 1484 wrote to memory of 2668	1484	cmd.exe	choice.exe

C:\Users\Admin\AppData\Local\Temp\5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe
"C:\Users\Admin\AppData\Local\Temp\5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
4⤵
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-0-0x0000000000140000-0x0000000000206000-memory.dmp

Filesize
792KB

Download
memory/1928-1-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/1928-3-0x0000000004260000-0x00000000042A0000-memory.dmp

Filesize
256KB

Download
memory/1928-2-0x0000000000800000-0x0000000000854000-memory.dmp

Filesize
336KB

Download
memory/1928-4-0x00000000004F0000-0x00000000004F8000-memory.dmp

Filesize
32KB

Download
memory/1928-15-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2336-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2336-5-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-18-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads