snakekeylogger | 4dceba1fa678ab8537d060e5011b98b292ffef554e492a3c19bfdf25d1f13118

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
15/03/2022, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P0A2249.exe
Size 1.0MB
Sample220315-raecnsafaq
SHA256 4dceba1fa678ab8537d060e5011b98b292ffef554e492a3c19bfdf25d1f13118
MD5 68225001c10ccf0865f92cd74d77e4cb
SHA1 119bc52de9586c33578cea34f137c6d75d80bf4e
SHA512 919c89a7b3e1be83ff81a37aa6bdc97d91c367a41b1ec92e28056a04eb39d5529eb6436901ded124995060a004ae2dd1dff0e533720293795512b0716dda6de5
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5273407003:AAG7ZG43PS1FZDrj0gADw0sr_lYis0K5EYU/sendMessage?chat_id=2028572980

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4216-141-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	checkip.dyndns.org
35	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1752 set thread context of 4216	1752	P0A2249.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	4216	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4216	P0A2249.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	P0A2249.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89
PID 1752 wrote to memory of 4216	1752	P0A2249.exe	89

C:\Users\Admin\AppData\Local\Temp\P0A2249.exe
"C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\P0A2249.exe
  "C:\Users\Admin\AppData\Local\Temp\P0A2249.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1528
    3⤵
    - Program crash
    PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4216 -ip 4216
1⤵
PID:3388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-134-0x00000000752A0000-0x0000000075A50000-memory.dmp

Download

memory/1752-135-0x0000000000D00000-0x0000000000E12000-memory.dmp

Download

memory/1752-136-0x0000000005D10000-0x00000000062B4000-memory.dmp

Download

memory/1752-137-0x0000000005800000-0x0000000005892000-memory.dmp

Download

memory/1752-138-0x0000000005760000-0x0000000005D04000-memory.dmp

Download

memory/1752-139-0x00000000057E0000-0x00000000057EA000-memory.dmp

Download

memory/1752-140-0x0000000009130000-0x00000000091CC000-memory.dmp

Download

memory/4216-141-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4216-143-0x00000000752A0000-0x0000000075A50000-memory.dmp

Download

memory/4216-144-0x0000000004F20000-0x00000000054C4000-memory.dmp

Download