snakekeylogger | 6dce2014b5351f42343b304524e4b242ef335ff91275ea19c01487a97cd9a2ad

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 14:26

Target

PAYMENT REQUIRED.exe
Size

1.0MB
MD5

f5685743bc8ee6bf329fcda725045f24
SHA1

bcbfd7137135e25b8da4724904c343504acf1a7a
SHA256

6dce2014b5351f42343b304524e4b242ef335ff91275ea19c01487a97cd9a2ad
SHA512

06cdd622ef1657ea5f24646899871ad50bfac4ffb2ad89eed56906acd5bb09d15dc6750c86e5193be91662c01f3ae48358745a472f5999e72c46f75283be7c11
SSDEEP

24576:VzfrUgh/awi2Dzada81nXIPjCzWvJKZ4J5AbZrCF:Vzfr3h/d9So81nXujg9bZ

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2064-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

PAYMENT REQUIRED.exe

description pid process target process

PID 3404 set thread context of 2064 3404 PAYMENT REQUIRED.exe PAYMENT REQUIRED.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

PAYMENT REQUIRED.exe

pid process

2064 PAYMENT REQUIRED.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PAYMENT REQUIRED.exe

description pid process

Token: SeDebugPrivilege 2064 PAYMENT REQUIRED.exe

flow	ioc
42	checkip.dyndns.org

description	pid	process	target process
PID 3404 set thread context of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe

pid	process
2064	PAYMENT REQUIRED.exe

description	pid	process
Token: SeDebugPrivilege	2064	PAYMENT REQUIRED.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PAYMENT REQUIRED.exe

description	pid	process	target process
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe
PID 3404 wrote to memory of 2064	3404	PAYMENT REQUIRED.exe	PAYMENT REQUIRED.exe

memory/2064-137-0x0000000000000000-mapping.dmp

Download
memory/2064-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3404-132-0x0000000000A00000-0x0000000000B0C000-memory.dmp

Filesize
1.0MB

Download
memory/3404-133-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/3404-134-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/3404-135-0x0000000005490000-0x000000000549A000-memory.dmp

Filesize
40KB

Download
memory/3404-136-0x0000000008FE0000-0x000000000907C000-memory.dmp

Filesize
624KB

Download