snakekeylogger | 0bbc06390e3dfc9e44bda66fbc1e08ef13cf3d0b0b49ae4e72305a840a352511

Analysis

max time kernel
103s
max time network
112s
platform
windows10_x64
resource
win10v20210410
submitted
09/08/2021, 05:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P.O. 110689-08-2021,pdf.exe
Size 244KB
Sample210809-r593ebk63n
SHA256 0bbc06390e3dfc9e44bda66fbc1e08ef13cf3d0b0b49ae4e72305a840a352511
MD5 39ae9cdb090b0983c5577e095e489236
SHA1 40f1308a87fca711b6aef961dfb8fe753dd20960
SHA512 e3daed03b0360e96ba3745844bdb91555a881e2dfc28a4d2bc372a6a9cc4953297cac2d48b6f887f1124161e594d4ada65dfd07102abf64e2931214161d4a721
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.leifhelt.com
Port
587
Username
[email protected]
Password
FyaPwg@U1

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
smtp.leifhelt.com
Port
587
Username
[email protected]
Password
FyaPwg@U1

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	checkip.dyndns.org
10	freegeoip.app
11	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4020 set thread context of 1044	4020	P.O. 110689-08-2021,pdf.exe	74

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1044	MSBuild.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4020	P.O. 110689-08-2021,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	MSBuild.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1044	4020	P.O. 110689-08-2021,pdf.exe	74
PID 4020 wrote to memory of 1044	4020	P.O. 110689-08-2021,pdf.exe	74
PID 4020 wrote to memory of 1044	4020	P.O. 110689-08-2021,pdf.exe	74
PID 4020 wrote to memory of 1044	4020	P.O. 110689-08-2021,pdf.exe	74
PID 1044 wrote to memory of 3164	1044	MSBuild.exe	77
PID 1044 wrote to memory of 3164	1044	MSBuild.exe	77
PID 1044 wrote to memory of 3164	1044	MSBuild.exe	77

C:\Users\Admin\AppData\Local\Temp\P.O. 110689-08-2021,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\P.O. 110689-08-2021,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\P.O. 110689-08-2021,pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:3164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-116-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1044-118-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/1044-119-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/1044-120-0x0000000005330000-0x000000000582E000-memory.dmp

Download

memory/1044-122-0x0000000006400000-0x0000000006401000-memory.dmp

Download

memory/1044-123-0x0000000006350000-0x0000000006351000-memory.dmp

Download

memory/1044-124-0x00000000062F0000-0x00000000062F1000-memory.dmp

Download

memory/4020-115-0x00000000001E0000-0x00000000001E2000-memory.dmp

Download