snakekeylogger | fb3a91a50d13151bcf7521ff3f8dc8a1ebfbbd737231660f5f07e29d4bf387b5

Analysis

max time kernel
78s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2022, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0dSDcPNy5SxGjnT.exe
Size 771KB
Sample220811-kdkkjafcd2
SHA256 fb3a91a50d13151bcf7521ff3f8dc8a1ebfbbd737231660f5f07e29d4bf387b5
MD5 2cd6f58e71376f1215d20e4d2323172c
SHA1 577977314b26885f517092d248d69f1ec4bcfdc6
SHA512 03b127dd7eb807ff3d5159bf4b3186d5d33951e3c0aa556438a46a0d756b4366fc29ba7e08aca7faf4ff68f4f731d89c6881eae762100c8f2df800df4907b1b9
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.valleycountysar.org
Port
26
Username
[email protected]
Password
-hNxyUsSS1,H
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/1140-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 868 set thread context of 1140	868	0dSDcPNy5SxGjnT.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1840	1140	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
868	0dSDcPNy5SxGjnT.exe
868	0dSDcPNy5SxGjnT.exe
1140	0dSDcPNy5SxGjnT.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	0dSDcPNy5SxGjnT.exe
Token: SeDebugPrivilege	1140	0dSDcPNy5SxGjnT.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 4944	868	0dSDcPNy5SxGjnT.exe	98
PID 868 wrote to memory of 4944	868	0dSDcPNy5SxGjnT.exe	98
PID 868 wrote to memory of 4944	868	0dSDcPNy5SxGjnT.exe	98
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99
PID 868 wrote to memory of 1140	868	0dSDcPNy5SxGjnT.exe	99

C:\Users\Admin\AppData\Local\Temp\0dSDcPNy5SxGjnT.exe
"C:\Users\Admin\AppData\Local\Temp\0dSDcPNy5SxGjnT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\0dSDcPNy5SxGjnT.exe
  "C:\Users\Admin\AppData\Local\Temp\0dSDcPNy5SxGjnT.exe"
  2⤵
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\0dSDcPNy5SxGjnT.exe
  "C:\Users\Admin\AppData\Local\Temp\0dSDcPNy5SxGjnT.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 1484
    3⤵
    - Program crash
    PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1140 -ip 1140
1⤵
PID:3660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

0dSDcPNy5SxGjnT.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0dSDcPNy5SxGjnT.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/868-130-0x0000000000980000-0x0000000000A48000-memory.dmp

Download

memory/868-131-0x00000000058F0000-0x0000000005E94000-memory.dmp

Download

memory/868-132-0x00000000053F0000-0x0000000005482000-memory.dmp

Download

memory/868-133-0x00000000055A0000-0x00000000055AA000-memory.dmp

Download

memory/868-134-0x0000000007B60000-0x0000000007BFC000-memory.dmp

Download

memory/868-135-0x0000000007E20000-0x0000000007E86000-memory.dmp

Download

memory/1140-138-0x0000000000400000-0x0000000000426000-memory.dmp

Download