snakekeylogger | af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b

Analysis

max time kernel
144s
max time network
149s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
21/11/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe
Size

928KB
MD5

bf45babf34aaf52c47cbca8553c4629c
SHA1

34da6def2b2d3dbb10577eb6a2cad4cb1e82d54d
SHA256

af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b
SHA512

a70cc6917236b40af5886c132588af67da8051dd260a13bf9e4b2d1697ac64234bb7952993b8eec12336553ab93cd67adec0f12537a15de8fccf5683f950e767
SSDEEP

24576:pe3ywOxBVBo0RawizoVCZcjK6NN3A+L74mBfNUstzo:pe3dOxBLfyzoI6NN

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

resource	yara_rule
behavioral1/memory/960-187-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/960-188-0x000000000042081E-mapping.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3668 set thread context of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
960	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67
PID 3668 wrote to memory of 960	3668	af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe	67

C:\Users\Admin\AppData\Local\Temp\af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe
"C:\Users\Admin\AppData\Local\Temp\af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe
  "C:\Users\Admin\AppData\Local\Temp\af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\af32a56f9c3d38ba2c045043d331749236cadc2f8b86dc376bee0c1e2299448b.exe.log

Filesize
1KB

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/960-187-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/960-189-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/960-190-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/960-191-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-155-0x0000000005120000-0x000000000561E000-memory.dmp

Filesize
5.0MB

Download
memory/3668-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-152-0x0000000000390000-0x000000000047E000-memory.dmp

Filesize
952KB

Download
memory/3668-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-157-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Filesize
584KB

Download
memory/3668-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-173-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

Filesize
40KB

Download
memory/3668-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

Filesize
1.6MB

Download
memory/3668-182-0x0000000004F30000-0x0000000004F48000-memory.dmp

Filesize
96KB

Download
memory/3668-183-0x0000000004F70000-0x0000000004F7C000-memory.dmp

Filesize
48KB

Download
memory/3668-184-0x0000000008630000-0x00000000086CE000-memory.dmp

Filesize
632KB

Download
memory/3668-185-0x0000000008770000-0x000000000880C000-memory.dmp

Filesize
624KB

Download
memory/3668-186-0x0000000008810000-0x0000000008876000-memory.dmp

Filesize
408KB

Download