snakekeylogger | ead9a36351d0a552a23d27cc691151086e7f68b8a8ab41d8852e18c8e7b5816e

Analysis

max time kernel
142s
max time network
155s
platform
windows10_x64
resource
win10-en-20211208
submitted
27/01/2022, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4401604a84e33a2f43ad734bdd86bdc.exe
Size 911KB
Sample220127-sa124seecj
SHA256 ead9a36351d0a552a23d27cc691151086e7f68b8a8ab41d8852e18c8e7b5816e
MD5 d4401604a84e33a2f43ad734bdd86bdc
SHA1 cb67b6182b0ea722d2e4e6802f8246750695e0f3
SHA512 5527f0ffbfc7ca08bde635398efc96b1b4874b997dc1b1213bf339687d1ad6395ced5ee3ced1159e6b82df21e650c740a2daf561c6fb8287ee279cff78362eba
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
BrazenDocike@1234

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3460-123-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3460	d4401604a84e33a2f43ad734bdd86bdc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	d4401604a84e33a2f43ad734bdd86bdc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71
PID 508 wrote to memory of 3460	508	d4401604a84e33a2f43ad734bdd86bdc.exe	71

C:\Users\Admin\AppData\Local\Temp\d4401604a84e33a2f43ad734bdd86bdc.exe
"C:\Users\Admin\AppData\Local\Temp\d4401604a84e33a2f43ad734bdd86bdc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Users\Admin\AppData\Local\Temp\d4401604a84e33a2f43ad734bdd86bdc.exe
  "C:\Users\Admin\AppData\Local\Temp\d4401604a84e33a2f43ad734bdd86bdc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-115-0x0000000000C30000-0x0000000000D1A000-memory.dmp

Download

memory/508-116-0x0000000005C60000-0x000000000615E000-memory.dmp

Download

memory/508-117-0x0000000005690000-0x0000000005722000-memory.dmp

Download

memory/508-118-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/508-119-0x0000000005760000-0x000000000576A000-memory.dmp

Download

memory/508-120-0x0000000005C50000-0x0000000005C5C000-memory.dmp

Download

memory/508-121-0x0000000007DE0000-0x0000000007E7C000-memory.dmp

Download

memory/508-122-0x00000000080C0000-0x0000000008188000-memory.dmp

Download

memory/3460-123-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/3460-124-0x0000000005640000-0x0000000005681000-memory.dmp

Download