snakekeylogger | 767ff6709f5ea14af565b50baca9c574d1ec22eb0ddfd8468b64adf7a4ea6ca4

Analysis

max time kernel
133s
max time network
133s
platform
windows7_x64
resource
win7v20210408
submitted
26/04/2021, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_6037_020120.exe
Size 358KB
Sample210426-d99gxtlda6
SHA256 767ff6709f5ea14af565b50baca9c574d1ec22eb0ddfd8468b64adf7a4ea6ca4
MD5 0a518c0c5bca90ed3a980a53543304ba
SHA1 9623da573c768ee895aef71572f19cc2c8ded61a
SHA512 47503069ea7b9149ed54835421be966a388e43dfe10c758babeed0538a43f939d8792a350d912b6b709130708d6d465064b475403bc60cc75cf720eea7d39fd6
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
server255.web-hosting.com
Port
587
Username
[email protected]
Password
Ffs4prb_QwX#

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1760-65-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger
behavioral1/memory/1760-66-0x000000000046474E-mapping.dmp	family_snakekeylogger
behavioral1/memory/1760-67-0x0000000000400000-0x000000000046A000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org
10	freegeoip.app
11	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 1760	1996	IMG_6037_020120.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1996	IMG_6037_020120.exe
1996	IMG_6037_020120.exe
1760	IMG_6037_020120.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	IMG_6037_020120.exe
Token: SeDebugPrivilege	1760	IMG_6037_020120.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29
PID 1996 wrote to memory of 1760	1996	IMG_6037_020120.exe	29

C:\Users\Admin\AppData\Local\Temp\IMG_6037_020120.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_6037_020120.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\IMG_6037_020120.exe
  C:\Users\Admin\AppData\Local\Temp\IMG_6037_020120.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-65-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1760-67-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1760-69-0x0000000004910000-0x0000000004911000-memory.dmp

Download

memory/1996-60-0x0000000001180000-0x0000000001181000-memory.dmp

Download

memory/1996-62-0x00000000003B0000-0x00000000003B5000-memory.dmp

Download

memory/1996-63-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/1996-64-0x0000000000470000-0x0000000000491000-memory.dmp

Download