snakekeylogger | e0cd24aec11fb4e4cdcd1e5932ca75ff201ab1087be33d3a3f94ed8e18a4eff2

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW_PO#671928273.exe
Size 1.0MB
Sample220920-jspmcsfhfq
SHA256 e0cd24aec11fb4e4cdcd1e5932ca75ff201ab1087be33d3a3f94ed8e18a4eff2
MD5 415954ffa0e22511ace125a0dac71ecc
SHA1 b6ed3636a9c47cc4bddcb3615853234a095c1b5d
SHA512 4c0e6dbce8027535701b08d926c446bedf070d55193323d9f707a4a508d597b69f0f8e8739b6150dafadb5381b5fadff6436c259483d65d115b0c64f974d3708
SSDEEP 12288:UycPeCXhywOPFbM2jG5zGg47eNJluhGGYswhPs9Um:JcPeGYyEQzGg0ipGYsP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5587666659:AAG8NrrXJQs__dhk8nLJBFOspz2my8OVpX0/sendMessage?chat_id=5569775004

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/956-139-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 956	2564	NEW_PO#671928273.exe	81

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
956	NEW_PO#671928273.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	NEW_PO#671928273.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81
PID 2564 wrote to memory of 956	2564	NEW_PO#671928273.exe	81

C:\Users\Admin\AppData\Local\Temp\NEW_PO#671928273.exe
"C:\Users\Admin\AppData\Local\Temp\NEW_PO#671928273.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\NEW_PO#671928273.exe
  "C:\Users\Admin\AppData\Local\Temp\NEW_PO#671928273.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-139-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2564-132-0x0000000000910000-0x0000000000A22000-memory.dmp

Download

memory/2564-133-0x0000000005950000-0x0000000005EF4000-memory.dmp

Download

memory/2564-134-0x0000000005440000-0x00000000054D2000-memory.dmp

Download

memory/2564-135-0x00000000053C0000-0x00000000053CA000-memory.dmp

Download

memory/2564-136-0x0000000008DD0000-0x0000000008E6C000-memory.dmp

Download

memory/2564-137-0x0000000008F70000-0x0000000008FD6000-memory.dmp

Download