snakekeylogger | 921a9d7e264ebdd6cd571b536733497be42e08ce26b1846fc1870220fc335b15

Analysis

max time kernel
134s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO 58873476`644.exe
Size 725KB
Sample221027-j8fpdsbec3
SHA256 921a9d7e264ebdd6cd571b536733497be42e08ce26b1846fc1870220fc335b15
MD5 cc897f28c7ac67ea1078420d3b4b9cb1
SHA1 72a27a63abbc6bc0b633993f16d397ab552ceb3a
SHA512 ffb80845184f5c7886cee67f8233928596330b22e5423fd8b49290cf4de0b7f26d2c2bce9b532ffcc4a5ae481628db3017c55e0e2d9d0c18f86645896b5c8baf
SSDEEP 12288:mHjF/f+zwwUaoHFOVGHVLfDGHsyCzAIUZD+ToMVsm1pqnS:GBG8wfwwGHVLfqNCzAIGD+To01pCS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5793325124:AAGHzRsq2tvLBf23l8pkEofcJjw4AQXsgAQ/sendMessage?chat_id=2086616067

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/1676-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1676-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1676-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1676-67-0x00000000004201CE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1676-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1676-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 1676	1964	PO 58873476`644.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	PO 58873476`644.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	PO 58873476`644.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28
PID 1964 wrote to memory of 1676	1964	PO 58873476`644.exe	28

C:\Users\Admin\AppData\Local\Temp\PO 58873476`644.exe
"C:\Users\Admin\AppData\Local\Temp\PO 58873476`644.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\PO 58873476`644.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 58873476`644.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-65-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1676-66-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1676-71-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1676-61-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1676-60-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1676-63-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1676-69-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1964-55-0x0000000076411000-0x0000000076413000-memory.dmp

Download

memory/1964-54-0x0000000000CC0000-0x0000000000D7C000-memory.dmp

Download

memory/1964-59-0x0000000000BE0000-0x0000000000C0C000-memory.dmp

Download

memory/1964-58-0x0000000004D90000-0x0000000004DF6000-memory.dmp

Download

memory/1964-57-0x00000000006F0000-0x00000000006FC000-memory.dmp

Download

memory/1964-56-0x0000000000450000-0x0000000000466000-memory.dmp

Download