Snake-Malware - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/snake-malware/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:22:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSnake Malware Registry Modification via .wav\OpenWithProgIdshttps://feed.craftedsignal.io/briefs/2026-10-snake-malware-registry/Mon, 12 Oct 2026 18:22:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-snake-malware-registry/Snake malware modifies the .wav\OpenWithProgIds registry path to facilitate the decryption of configuration blobs used by WerFault.exe to load malicious kernel drivers.Snake malware, a sophisticated espionage tool, utilizes specific registry modifications as a mechanism to decrypt critical configuration data. The malware targets the registry path ".wav\OpenWithProgIds" to store or trigger the retrieval of encrypted blobs. When accessed by the legitimate Windows process 'WerFault.exe', this registry data is decrypted to reveal essential components, including AES keys, initialization vectors (IVs), and the file paths required to load the malware's custom kernel driver and loader. This technique allows the malware to bypass traditional signature-based detection by keeping its core configuration encrypted and off-disk until runtime. For defenders, monitoring modifications to this specific registry key is a high-fidelity signal of Snake malware activity, as legitimate applications rarely utilize this path for configuration storage.

Attack Chain

  1. Initial compromise occurs, allowing the execution of the Snake loader.
  2. The loader prepares the malicious payload and necessary configuration data.
  3. The malware writes an encrypted blob or modifies subkeys within ".wav\OpenWithProgIds" in the Windows Registry.
  4. 'WerFault.exe' is invoked or coerced into processing the modified registry values.
  5. The malware uses the stored registry data to derive the AES key and IV.
  6. Decryption of the configuration blob exposes paths to the final-stage kernel driver.
  7. The kernel driver is loaded into the operating system memory, granting the attacker persistent, high-privilege access.
  8. Final objective of espionage or exfiltration is achieved through the active kernel-level presence.

Impact

Successful exploitation by Snake malware results in full system compromise via kernel-level access. This allows for stealthy, long-term persistence that is extremely difficult to detect or remove from the OS. Historically, this malware has targeted sensitive government and critical infrastructure sectors. Compromise leads to significant risks of data exfiltration and complete loss of control over the affected host.

Recommendation

  • Deploy the Sigma rule below to detect unauthorized modifications to the .wav registry hive.
  • Enable Sysmon Event ID 13 (Registry Event) logging across all endpoints to capture the necessary 'TargetObject' and 'Details' information.
  • Investigate any processes modifying the .wav\OpenWithProgIds key that are not part of a documented, legitimate software update or deployment.
  • Utilize the provided Atomic Red Team test (Guid: 8318ad20-0488-4a64-98f4-72525a012f6b) to validate detection coverage in your environment.
]]>highadvisorysnake-malwareregistrydefense-evasionpersistenceDetection of Snake Malware Kernel Driver Installation Artifactshttps://feed.craftedsignal.io/briefs/2026-10-snake-malware/Mon, 12 Oct 2026 18:22:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-snake-malware/Snake Malware utilizes the creation of a specifically named file, 'comadmin.dat', within the system32\Com directory to facilitate the installation and loading of a malicious kernel driver for persistence and privilege escalation.Snake Malware, also known as Turla, is a sophisticated threat targeting critical infrastructure and government entities. The malware employs a modular architecture that relies on custom kernel drivers to maintain deep control over compromised systems. A critical component of its installation routine is the creation of a file named 'comadmin.dat' within the '%windows%\system32\Com' directory. This file serves as a staging artifact for loading a kernel-mode driver, enabling the threat actor to bypass standard security controls, gain persistent access, and execute arbitrary code with elevated privileges. Monitoring for the creation of this specific file in the system32 directory provides a high-fidelity signal for detecting the active deployment phase of the Snake rootkit.

Attack Chain

  1. Initial access is established via spearphishing or exploiting unpatched edge vulnerabilities.
  2. The threat actor executes a dropper or installer to initiate the malware deployment.
  3. The installer identifies the target system path for the rootkit components.
  4. The installer writes 'comadmin.dat' to 'C:\Windows\system32\Com\'.
  5. The malware performs a side-loading or registry manipulation to register the associated kernel driver.
  6. The system is rebooted or a service is triggered to load the malicious driver into the Windows kernel.
  7. The driver provides the attacker with kernel-level visibility and persistent control.
  8. The final objective is the exfiltration of sensitive data or long-term espionage within the victim network.

Impact

Successful deployment of the Snake kernel driver grants the attacker full visibility into the compromised host's operating system, enabling the interception of network traffic, sensitive file access, and evasion of endpoint detection and response (EDR) agents. This threat is primarily observed in high-value, targeted espionage campaigns against government and diplomatic sectors.

Recommendation

  • Deploy the Sigma rule below to monitor for the creation of the 'comadmin.dat' file in the specified system path.
  • Enable Sysmon Event ID 11 (FileCreate) to capture the necessary telemetry for this detection.
  • Investigate any detected 'comadmin.dat' file creations immediately, as this artifact is highly specific to Snake Malware.
  • Review system and application logs for suspicious service installations or registry modifications corresponding to the timestamp of the file creation event.
]]>highadvisorysnake-malwarekernel-driverpersistenceturlawindows