snakekeylogger | c980b05670bf5afdf79a65fb6e0f0e2ad6c7bf6833c23870848dcfcac3e1437b

Analysis

max time kernel
125s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
12/04/2022, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order PO-33908.pdf.exe
Size 564KB
Sample220412-e5c2wahhd7
SHA256 c980b05670bf5afdf79a65fb6e0f0e2ad6c7bf6833c23870848dcfcac3e1437b
MD5 506c30ba8c38212a89084d500ceae23c
SHA1 a818f801b6302fba30ad46915e31e9e48499a617
SHA512 33117a10478d4a47f51ce7093be962f1398f2d9d84dde111435d2a77d947902542f452ea1258f31668726e71fd1d4bb1f6184c78fec2086d0fdeecb295b4b568
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
stilltech.ro
Port
587
Username
[email protected]
Password
eurobit555ro
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3212-131-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4740 set thread context of 3212	4740	Purchase Order PO-33908.pdf.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4120	3212	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3212	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88
PID 4740 wrote to memory of 3212	4740	Purchase Order PO-33908.pdf.exe	88

C:\Users\Admin\AppData\Local\Temp\Purchase Order PO-33908.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order PO-33908.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1460
    3⤵
    - Program crash
    PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3212 -ip 3212
1⤵
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3212-131-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4740-124-0x0000000000D20000-0x0000000000DB2000-memory.dmp

Download

memory/4740-125-0x0000000005D20000-0x00000000062C4000-memory.dmp

Download

memory/4740-126-0x0000000005810000-0x00000000058A2000-memory.dmp

Download

memory/4740-127-0x0000000005790000-0x000000000579A000-memory.dmp

Download

memory/4740-128-0x00000000093A0000-0x000000000943C000-memory.dmp

Download

memory/4740-129-0x0000000009590000-0x00000000095F6000-memory.dmp

Download