snakekeylogger | 2f559cf9248a782155f4ce8dbbdfe65c1fd714ba355a5dc20683d2a5068178f7

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HBL Report.exe
Size 998KB
Sample221014-glv5fsaff9
SHA256 2f559cf9248a782155f4ce8dbbdfe65c1fd714ba355a5dc20683d2a5068178f7
MD5 7ee0783fcb1f1ecaa288244fd15e9b44
SHA1 e1d93c7d3e9444b96db6f6233e22fad9e14c204d
SHA512 8b8282e740a8e4bb5ac637859e8a88c7dbca54628be16059b142c04f04136f32dbdb648458d570dc1123c616b8585e567a01b9111ea4e1c0c1f7b6ec718b36d0
SSDEEP 12288:g5/LxGw8tJDXRMVpPblWSFI43QsDLCbVymY+c2P6/dSD98CARXw:gGhJDXRUlWsHDdmY+XaSD9+K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
qlRYaFn8
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/3412-139-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1780 set thread context of 3412	1780	HBL Report.exe	90

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3396	3412	WerFault.exe	90
2644	3412	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3412	HBL Report.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	HBL Report.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 1780 wrote to memory of 3412	1780	HBL Report.exe	90
PID 3412 wrote to memory of 3396	3412	HBL Report.exe	95
PID 3412 wrote to memory of 3396	3412	HBL Report.exe	95
PID 3412 wrote to memory of 3396	3412	HBL Report.exe	95

C:\Users\Admin\AppData\Local\Temp\HBL Report.exe
"C:\Users\Admin\AppData\Local\Temp\HBL Report.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Users\Admin\AppData\Local\Temp\HBL Report.exe
  "C:\Users\Admin\AppData\Local\Temp\HBL Report.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1484
    3⤵
    - Program crash
    PID:3396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 1484
    3⤵
    - Program crash
    PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3412 -ip 3412
1⤵
PID:4512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

HBL Report.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HBL Report.exe.log
Size 1KB
SHA256 bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
MD5 e08f822522c617a40840c62e4b0fb45e
SHA1 ae516dca4da5234be6676d3f234c19ec55725be7
SHA512 894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
MD5 SHA1 SHA512

Submit Download

memory/1780-132-0x0000000000190000-0x0000000000290000-memory.dmp

Download

memory/1780-133-0x0000000005470000-0x0000000005A14000-memory.dmp

Download

memory/1780-134-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Download

memory/1780-135-0x00000000027C0000-0x00000000027CA000-memory.dmp

Download

memory/1780-136-0x0000000009880000-0x000000000991C000-memory.dmp

Download

memory/1780-137-0x0000000009A20000-0x0000000009A86000-memory.dmp

Download

memory/3412-139-0x0000000000400000-0x0000000000426000-memory.dmp

Download