snakekeylogger | 68ea38997c73f63cd68dea8bb6e2ecd5b5f6f5bf3a5f1597083bb674fdf3901f

Analysis

max time kernel
147s
max time network
204s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO MM21PB81009AK32.exe
Size 798KB
Sample221012-jcd6pachbn
SHA256 68ea38997c73f63cd68dea8bb6e2ecd5b5f6f5bf3a5f1597083bb674fdf3901f
MD5 11477d58c33da552ac32c7d4e43f135d
SHA1 1c2cc563267f8ff19dc031283d3e2e6793b37cb2
SHA512 956854632048a3a457d86b059c51013f15ba379dbf8039ea8a799cb9874e2b20a5456386ddd3bab8fe2a7243a6b2c3d0ab93fc3c65f0142b49d6aff4c4a52fb2
SSDEEP 12288:/p/KGhMJXFa+CLifnTRTqI9nF7uD8WbGQ:/hMC+hRT9wD8+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5793325124:AAGHzRsq2tvLBf23l8pkEofcJjw4AQXsgAQ/sendMessage?chat_id=2086616067

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/1328-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-67-0x00000000004201CE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1328-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1328-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1328	1964	PO MM21PB81009AK32.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1328	PO MM21PB81009AK32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	PO MM21PB81009AK32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28
PID 1964 wrote to memory of 1328	1964	PO MM21PB81009AK32.exe	28

C:\Users\Admin\AppData\Local\Temp\PO MM21PB81009AK32.exe
"C:\Users\Admin\AppData\Local\Temp\PO MM21PB81009AK32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\PO MM21PB81009AK32.exe
  "C:\Users\Admin\AppData\Local\Temp\PO MM21PB81009AK32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-65-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-71-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-61-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-66-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-60-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-63-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1328-69-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1964-55-0x0000000075281000-0x0000000075283000-memory.dmp

Download

memory/1964-54-0x0000000000230000-0x00000000002FC000-memory.dmp

Download

memory/1964-59-0x0000000002090000-0x00000000020B6000-memory.dmp

Download

memory/1964-58-0x0000000005BF0000-0x0000000005C70000-memory.dmp

Download

memory/1964-57-0x00000000005C0000-0x00000000005CC000-memory.dmp

Download

memory/1964-56-0x00000000006D0000-0x00000000006EA000-memory.dmp

Download