snakekeylogger | f8c1fe21952aca8d7170c335b2c6fa16c20d3589895f9cb3d1a06d1110c06436

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2022 11:33

Target

Halkbank_Ekstre_20221031_075819_154055.exe
Size

1.1MB
MD5

c16f28f1e257a32110dca670fac2c959
SHA1

4c91da1a107ecee2ba32f248b15c4059d2671e8e
SHA256

f8c1fe21952aca8d7170c335b2c6fa16c20d3589895f9cb3d1a06d1110c06436
SHA512

148094d0983a29f767ba0167c078d3561f8100aa1d760996e82ea891cff306de7c4f56650288af705c516a875ff1fdcc05252b12f1e07e6e9126ec24a19f5e6c
SSDEEP

12288:tODa0bWs3zS6Mcbl0B4fozD8VTeHmylTme9knER+0Defs2sFLTAehm8buS89W:H0Ss3zSdcR+D4MfTme9Yf8TAqbD

Score

10^/10

Family

snakekeylogger

https://api.telegram.org/bot5478319803:AAHq9LkDUFBRvjOub4YfRlPURZxM59_BVnc/sendMessage?chat_id=5516439768

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/112-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3060 set thread context of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3488	112	WerFault.exe	88

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
112	Halkbank_Ekstre_20221031_075819_154055.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	Halkbank_Ekstre_20221031_075819_154055.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88
PID 3060 wrote to memory of 112	3060	Halkbank_Ekstre_20221031_075819_154055.exe	88

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 112 -ip 112
1⤵
PID:4420

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20221031_075819_154055.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/112-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3060-132-0x0000000000B30000-0x0000000000C4A000-memory.dmp

Filesize
1.1MB

Download
memory/3060-133-0x0000000005A90000-0x0000000006034000-memory.dmp

Filesize
5.6MB

Download
memory/3060-134-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/3060-135-0x0000000005780000-0x000000000578A000-memory.dmp

Filesize
40KB

Download
memory/3060-136-0x0000000007FF0000-0x000000000808C000-memory.dmp

Filesize
624KB

Download