snakekeylogger | cd72c90ff3b610e07cf4df339ea8ead886c57ab93f48acb7482c78fa34a9c6d4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
11/04/2022, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO_82212_00.pdf.exe
Size 561KB
Sample220411-d22emacbf2
SHA256 cd72c90ff3b610e07cf4df339ea8ead886c57ab93f48acb7482c78fa34a9c6d4
MD5 1f4e15ff261df08988db641148a0a58b
SHA1 56619bb7cc51c03752f0d5a16bd27f51b13e329d
SHA512 53be6544c007cbb85262b469dbe4e3993f83737fd75cf5c340b50ba1b049c5025c98c4359389a1471d9c73f9a423d6809f496bbff2ccce4aad34c0da5c3a6425
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
stilltech.ro
Port
587
Username
[email protected]
Password
eurobit555ro
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2520-131-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
45	checkip.dyndns.org
47	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3628 set thread context of 2520	3628	PO_82212_00.pdf.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	2520	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2520	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	RegSvcs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3628	PO_82212_00.pdf.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3628	PO_82212_00.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88
PID 3628 wrote to memory of 2520	3628	PO_82212_00.pdf.exe	88

C:\Users\Admin\AppData\Local\Temp\PO_82212_00.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO_82212_00.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 1508
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2520 -ip 2520
1⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-131-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3628-124-0x0000000000570000-0x0000000000602000-memory.dmp

Download

memory/3628-125-0x0000000005660000-0x0000000005C04000-memory.dmp

Download

memory/3628-126-0x0000000004FF0000-0x0000000005082000-memory.dmp

Download

memory/3628-127-0x0000000004FC0000-0x0000000004FCA000-memory.dmp

Download

memory/3628-128-0x0000000007480000-0x000000000751C000-memory.dmp

Download

memory/3628-129-0x0000000007790000-0x00000000077F6000-memory.dmp

Download