snakekeylogger | aad2d6aa84c1d45931d729c3b1c6393ffa2be48e94de553f82c64543d8150b74

Analysis

max time kernel
152s
max time network
167s
platform
windows10_x64
resource
win10-en-20211014
submitted
16/11/2021, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invoice#345674.exe
Size 350KB
Sample211116-hlctjscfe9
SHA256 aad2d6aa84c1d45931d729c3b1c6393ffa2be48e94de553f82c64543d8150b74
MD5 55887e47a4af465039475a4e88fa9cb3
SHA1 1d95ab71dc1c4cb56fa02c44dd5e7dfb104800bd
SHA512 8dbcb7dda0c6d0658fff2c72e29d74a39fff5b59b254148b15e7dfcd2842827b6752a77c47e9498ff45637601b6240626e4753365bb1e2e972f43e94202af1df
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.alroman.com
Port
587
Username
[email protected]
Password
abc@24638

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	checkip.dyndns.org
31	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 1240	648	invoice#345674.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3524	1240	WerFault.exe	70

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1240	RegSvcs.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe
3524	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	RegSvcs.exe
Token: SeRestorePrivilege	3524	WerFault.exe
Token: SeBackupPrivilege	3524	WerFault.exe
Token: SeDebugPrivilege	3524	WerFault.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70
PID 648 wrote to memory of 1240	648	invoice#345674.exe	70

C:\Users\Admin\AppData\Local\Temp\invoice#345674.exe
"C:\Users\Admin\AppData\Local\Temp\invoice#345674.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1444
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-118-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/648-120-0x0000000005C00000-0x0000000005C01000-memory.dmp

Download

memory/648-121-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/648-122-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/648-123-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/648-124-0x0000000007B10000-0x0000000007B17000-memory.dmp

Download

memory/648-125-0x0000000007E40000-0x0000000007E41000-memory.dmp

Download

memory/648-126-0x0000000007DF0000-0x0000000007E2D000-memory.dmp

Download

memory/1240-127-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1240-133-0x00000000053D0000-0x00000000058CE000-memory.dmp

Download