snakekeylogger | e04f325187fb33cad41ff1631bb9cd422b9c805bfdbf00e08edae9358f4023e0

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2022, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1286556b3d8c3c2f89e0a302456786f7.exe
Size 809KB
Sample220715-pebfgabeep
SHA256 e04f325187fb33cad41ff1631bb9cd422b9c805bfdbf00e08edae9358f4023e0
MD5 1286556b3d8c3c2f89e0a302456786f7
SHA1 e44c1455919cb3d6aa4eea8736e607c7f26f13c0
SHA512 db2625a000898bea9693ca5edfcddaa007cd551c5a6773ce490b4f11721fb2cd29ff84315a9488f50607ce37bebf68d26f2a18d6af0ada2134b1a034b1d00b1b
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
cp5ua.hyperhost.ua
Port
587
Username
[email protected]
Password
7213575aceACE@#$
Email to
[email protected]

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2380-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5040	2380	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4988	1286556b3d8c3c2f89e0a302456786f7.exe
4988	1286556b3d8c3c2f89e0a302456786f7.exe
2380	1286556b3d8c3c2f89e0a302456786f7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	1286556b3d8c3c2f89e0a302456786f7.exe
Token: SeDebugPrivilege	2380	1286556b3d8c3c2f89e0a302456786f7.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 1104	4988	1286556b3d8c3c2f89e0a302456786f7.exe	91
PID 4988 wrote to memory of 1104	4988	1286556b3d8c3c2f89e0a302456786f7.exe	91
PID 4988 wrote to memory of 1104	4988	1286556b3d8c3c2f89e0a302456786f7.exe	91
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92
PID 4988 wrote to memory of 2380	4988	1286556b3d8c3c2f89e0a302456786f7.exe	92

C:\Users\Admin\AppData\Local\Temp\1286556b3d8c3c2f89e0a302456786f7.exe
"C:\Users\Admin\AppData\Local\Temp\1286556b3d8c3c2f89e0a302456786f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\1286556b3d8c3c2f89e0a302456786f7.exe
  "C:\Users\Admin\AppData\Local\Temp\1286556b3d8c3c2f89e0a302456786f7.exe"
  2⤵
  PID:1104
- C:\Users\Admin\AppData\Local\Temp\1286556b3d8c3c2f89e0a302456786f7.exe
  "C:\Users\Admin\AppData\Local\Temp\1286556b3d8c3c2f89e0a302456786f7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 1500
    3⤵
    - Program crash
    PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 2380
1⤵
PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

1286556b3d8c3c2f89e0a302456786f7.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1286556b3d8c3c2f89e0a302456786f7.exe.log
Size 1KB
SHA256 555433299641100efeaaa819ca6c261d12dd9b265916606ce6644e8abda57b1f
MD5 2b66f4402c5eccd587ec481a4d8bcc6a
SHA1 3913c42aa261156684a1efd83f94c590412064b7
SHA512 3fa690b02e3a61255546a91bb48369616bc7bb69e4f846e0a8bdae60058be5aba40665fe1bdb6debc784c77efcf5d7a17b1f91691fb396cbf79ad36dd207a8cb
MD5 SHA1 SHA512

Submit Download

memory/2380-138-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4988-130-0x0000000000DB0000-0x0000000000E80000-memory.dmp

Download

memory/4988-131-0x0000000005DA0000-0x0000000006344000-memory.dmp

Download

memory/4988-132-0x0000000005890000-0x0000000005922000-memory.dmp

Download

memory/4988-133-0x0000000005830000-0x000000000583A000-memory.dmp

Download

memory/4988-134-0x0000000007D60000-0x0000000007DFC000-memory.dmp

Download

memory/4988-135-0x000000000BBA0000-0x000000000BC06000-memory.dmp

Download