snakekeylogger | cc51930e1bf5d04d561e6841f7d5700dd46e62111444c42ed088ba5e725c5a32

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/09/2022, 06:37

Target

FaturaBildirim.exe
Size

1.4MB
MD5

815ccb0b22b29afba3ba964d9ffa01cf
SHA1

b115978c440a2ca3b725354e83cca1edb86c807c
SHA256

cc51930e1bf5d04d561e6841f7d5700dd46e62111444c42ed088ba5e725c5a32
SHA512

a2f3813fe11a4d0df92275c9a6cc1a20ad97c1ff48ca62f9125f05df27097a9f2609d90705bac86cccaa5dad1bad5f81be9460f9282246d92ba935f654927177
SSDEEP

12288:dYn84ksmAW6xaJlxvhfhVzhlQEpmAa8ifgTGld9S0BSffGRrLb0:dYn8u+lL5Vzh+JAW2G4003gH

Score

10^/10

Family

snakekeylogger

https://api.telegram.org/bot5478319803:AAHq9LkDUFBRvjOub4YfRlPURZxM59_BVnc/sendMessage?chat_id=5516439768

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/1616-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1616-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1616-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1616-67-0x00000000004201DE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1616-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1616-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1616	1644	FaturaBildirim.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1616	FaturaBildirim.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1616	FaturaBildirim.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28
PID 1644 wrote to memory of 1616	1644	FaturaBildirim.exe	28

memory/1616-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1616-71-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1616-65-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1616-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1616-60-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1616-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1616-69-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1644-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1644-54-0x00000000010C0000-0x0000000001220000-memory.dmp

Filesize
1.4MB

Download
memory/1644-59-0x00000000047B0000-0x00000000047D6000-memory.dmp

Filesize
152KB

Download
memory/1644-58-0x00000000050A0000-0x0000000005120000-memory.dmp

Filesize
512KB

Download
memory/1644-57-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/1644-56-0x0000000000B20000-0x0000000000B3A000-memory.dmp

Filesize
104KB

Download