snakekeylogger | fe1dfff6059a01908ff1a544b75aa5d974a39eb8192d4e7869a162c4f6d64c8a

Analysis

max time kernel
142s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2022, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wealthzx.exe
Size 628KB
Sample220812-q5sywadhfl
SHA256 fe1dfff6059a01908ff1a544b75aa5d974a39eb8192d4e7869a162c4f6d64c8a
MD5 194758d4b510b70894ef6f0bb67e4909
SHA1 7dbcaf692bf7cbdda4d99312117c0af51d5edd8e
SHA512 5134600f0b09c54ce35049aaf5ab6aec102b72b764ce07307f30b5f478e85df9bf07178458ba9c012f9a3b7c987f677993ae4e363ba6bc6ffc1c971ba652680c
MD5 SHA1 SHA512

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
cp5ua.hyperhost.ua
Port
587
Username
[email protected]
Password
7213575aceACE@#$
Email to
[email protected]

https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4248-140-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 4248	2956	wealthzx.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4600	4248	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2956	wealthzx.exe
2956	wealthzx.exe
4248	wealthzx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	wealthzx.exe
Token: SeDebugPrivilege	4248	wealthzx.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 384	2956	wealthzx.exe	92
PID 2956 wrote to memory of 384	2956	wealthzx.exe	92
PID 2956 wrote to memory of 384	2956	wealthzx.exe	92
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93
PID 2956 wrote to memory of 4248	2956	wealthzx.exe	93

C:\Users\Admin\AppData\Local\Temp\wealthzx.exe
"C:\Users\Admin\AppData\Local\Temp\wealthzx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\wealthzx.exe
  "C:\Users\Admin\AppData\Local\Temp\wealthzx.exe"
  2⤵
  PID:384
- C:\Users\Admin\AppData\Local\Temp\wealthzx.exe
  "C:\Users\Admin\AppData\Local\Temp\wealthzx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1492
    3⤵
    - Program crash
    PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4248 -ip 4248
1⤵
PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

wealthzx.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wealthzx.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/2956-132-0x0000000000430000-0x00000000004D4000-memory.dmp

Download

memory/2956-133-0x00000000053F0000-0x0000000005994000-memory.dmp

Download

memory/2956-134-0x0000000004EE0000-0x0000000004F72000-memory.dmp

Download

memory/2956-135-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Download

memory/2956-136-0x00000000076B0000-0x000000000774C000-memory.dmp

Download

memory/2956-137-0x00000000077C0000-0x0000000007826000-memory.dmp

Download

memory/4248-140-0x0000000000400000-0x0000000000426000-memory.dmp

Download