snakekeylogger | 3b695b07688c63dd2fd27374e20c320187dc74cb04a542ccb210e0b366b6e2b6

Analysis

max time kernel
170s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/06/2022, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OPOLIPO crypted file.exe
Size 806KB
Sample220615-wwfvvaddf9
SHA256 3b695b07688c63dd2fd27374e20c320187dc74cb04a542ccb210e0b366b6e2b6
MD5 5901fc75558fc7a52a05bbece0e03f7f
SHA1 0e995b8be195f99d623cbc8caa4d7a6090b3a2ee
SHA512 2e7b7001ad43de4e688dd1b65ce13a5f773f7b47d67284623539924ec9305819f4107bfc2968e9f5d3cc86594effbd6db68547df191717d2e2f40dca2f995c53
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5535884739:AAHyCKwRk3N2UhCoTSVKrS1bKCpj1vRU1IE/sendMessage?chat_id=5535975116

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2900-136-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2636 set thread context of 2900	2636	OPOLIPO crypted file.exe	84

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	OPOLIPO crypted file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2900	OPOLIPO crypted file.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84
PID 2636 wrote to memory of 2900	2636	OPOLIPO crypted file.exe	84

C:\Users\Admin\AppData\Local\Temp\OPOLIPO crypted file.exe
"C:\Users\Admin\AppData\Local\Temp\OPOLIPO crypted file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\OPOLIPO crypted file.exe
  "C:\Users\Admin\AppData\Local\Temp\OPOLIPO crypted file.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

OPOLIPO crypted file.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\OPOLIPO crypted file.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/2636-130-0x0000000000180000-0x0000000000250000-memory.dmp

Download

memory/2636-131-0x0000000005140000-0x00000000056E4000-memory.dmp

Download

memory/2636-132-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Download

memory/2636-133-0x0000000004C00000-0x0000000004C0A000-memory.dmp

Download

memory/2636-134-0x0000000008810000-0x00000000088AC000-memory.dmp

Download

memory/2900-136-0x0000000000400000-0x0000000000426000-memory.dmp

Download