snakekeylogger | aa523369b3ffbf4e3afc4b90509c50868b993f458987476f18e41c22628dfc46

Analysis

max time kernel
128s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order.exe
Size 805KB
Sample221124-yttp2aae6v
SHA256 aa523369b3ffbf4e3afc4b90509c50868b993f458987476f18e41c22628dfc46
MD5 3f29812ce47f4addb04a62d92f35913f
SHA1 8af473414ecabf98975949c6f240479582a226a5
SHA512 21f06c2263f0958405239b828cf5dd57e85cab7ddd7ed42775f6b3e4324cb6237d27299da2050f98d1a34ebfea49ae461c7c1bc278073faa082c02eb36d6e5e3
SSDEEP 12288:NNmZJbxpDF2zZHXYxtO0xQOLkk3nRmtwVRwc+d0RSs/KMGEmb/lYMXIANgJjSC:NN3zJv0CwHVRwRd0RGEulYFSC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

resource	yara_rule
behavioral1/memory/1708-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1708-65-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1708-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1708-67-0x00000000004206CE-mapping.dmp	family_snakekeylogger
behavioral1/memory/1708-69-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1708-71-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1708	2032	Purchase Order.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	Purchase Order.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	Purchase Order.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28
PID 2032 wrote to memory of 1708	2032	Purchase Order.exe	28

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-65-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1708-66-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1708-71-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1708-60-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1708-61-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1708-63-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1708-69-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2032-55-0x0000000076261000-0x0000000076263000-memory.dmp

Download

memory/2032-54-0x00000000013C0000-0x000000000148E000-memory.dmp

Download

memory/2032-59-0x0000000005B90000-0x0000000005BF0000-memory.dmp

Download

memory/2032-58-0x0000000007D20000-0x0000000007DBA000-memory.dmp

Download

memory/2032-57-0x00000000008A0000-0x00000000008AC000-memory.dmp

Download

memory/2032-56-0x0000000000900000-0x0000000000918000-memory.dmp

Download