snakekeylogger | 3595fe44e3dec516589eae7f91296f3d73663fd4f54023c6e4ec706948d6d90c

Analysis

max time kernel
45s
max time network
72s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/09/2022, 07:36

Target

7abddd84a926d518913f45f037ff6fd8.exe
Size

122KB
MD5

7abddd84a926d518913f45f037ff6fd8
SHA1

c0cef67c5629996ca42c0a8b873bc9336e1fd3fb
SHA256

3595fe44e3dec516589eae7f91296f3d73663fd4f54023c6e4ec706948d6d90c
SHA512

efb2ddfc42949677bdf4d711e5fdcf2a5515d2fe4e057521012fdcd185969400e16ea26d1bd52a38782b866cd85ed9d547f2c20395dbb1430ba9d32f9fd36f63
SSDEEP

3072:IfBdrbSs0q56KsTFTztgVtLD9YKl/MbIWRPwBVsFbY:aVWTztgVtLD9P/MbIrIb

Score

10^/10

Family

snakekeylogger

Credentials

https://api.telegram.org/bot5476629412:AAGbkcFsGq72YxKoGZjVmRBskss9nHikjMc/sendMessage?chat_id=5594190904

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral1/memory/1324-54-0x0000000000170000-0x0000000000194000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
760	1324	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1324	7abddd84a926d518913f45f037ff6fd8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	7abddd84a926d518913f45f037ff6fd8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 760	1324	7abddd84a926d518913f45f037ff6fd8.exe	27
PID 1324 wrote to memory of 760	1324	7abddd84a926d518913f45f037ff6fd8.exe	27
PID 1324 wrote to memory of 760	1324	7abddd84a926d518913f45f037ff6fd8.exe	27
PID 1324 wrote to memory of 760	1324	7abddd84a926d518913f45f037ff6fd8.exe	27

C:\Users\Admin\AppData\Local\Temp\7abddd84a926d518913f45f037ff6fd8.exe
"C:\Users\Admin\AppData\Local\Temp\7abddd84a926d518913f45f037ff6fd8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 1004
  2⤵
  - Program crash
  PID:760

memory/1324-54-0x0000000000170000-0x0000000000194000-memory.dmp

Filesize
144KB

Download
memory/1324-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download