snakekeylogger | 882b7341097daf24a557e47628146f30fcea8278d6bda89395a99d4e221ce192

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 16:51

Target

7a4673b50b07619e447b288b6e8211f8.exe
Size

810KB
MD5

7a4673b50b07619e447b288b6e8211f8
SHA1

e273bfb4838093421d49e96f926937af25f15fb6
SHA256

882b7341097daf24a557e47628146f30fcea8278d6bda89395a99d4e221ce192
SHA512

7b00434660833c3dc761a7418a7430bbd4f3136543d918024db55095a0a12be6d957360d9e9372c93fbbf7f261634531f0fb27d705b8a2d5983b21997e55d421
SSDEEP

12288:dkmZJbxpDFoefvjqOBQnHJ/BN0RYvedlCPWs0snu2eHOMKSxstjSC:dkaBQnJ0RYvAlSdRe6D0C

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1440-139-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

32 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

7a4673b50b07619e447b288b6e8211f8.exe

description pid process target process

PID 856 set thread context of 1440 856 7a4673b50b07619e447b288b6e8211f8.exe 7a4673b50b07619e447b288b6e8211f8.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2288 1440 WerFault.exe 7a4673b50b07619e447b288b6e8211f8.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7a4673b50b07619e447b288b6e8211f8.exe7a4673b50b07619e447b288b6e8211f8.exe

pid process

856 7a4673b50b07619e447b288b6e8211f8.exe
856 7a4673b50b07619e447b288b6e8211f8.exe
1440 7a4673b50b07619e447b288b6e8211f8.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7a4673b50b07619e447b288b6e8211f8.exe7a4673b50b07619e447b288b6e8211f8.exe

description pid process

Token: SeDebugPrivilege 856 7a4673b50b07619e447b288b6e8211f8.exe
Token: SeDebugPrivilege 1440 7a4673b50b07619e447b288b6e8211f8.exe

flow	ioc
32	checkip.dyndns.org

description	pid	process	target process
PID 856 set thread context of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe

pid	pid_target	process	target process
2288	1440	WerFault.exe	7a4673b50b07619e447b288b6e8211f8.exe

description	pid	process
Token: SeDebugPrivilege	856	7a4673b50b07619e447b288b6e8211f8.exe
Token: SeDebugPrivilege	1440	7a4673b50b07619e447b288b6e8211f8.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

7a4673b50b07619e447b288b6e8211f8.exe

description	pid	process	target process
PID 856 wrote to memory of 1324	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1324	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1324	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe
PID 856 wrote to memory of 1440	856	7a4673b50b07619e447b288b6e8211f8.exe	7a4673b50b07619e447b288b6e8211f8.exe

C:\Users\Admin\AppData\Local\Temp\7a4673b50b07619e447b288b6e8211f8.exe
"C:\Users\Admin\AppData\Local\Temp\7a4673b50b07619e447b288b6e8211f8.exe"
2⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 1536
3⤵
- Program crash
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1440 -ip 1440
1⤵
PID:4392

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7a4673b50b07619e447b288b6e8211f8.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/856-132-0x0000000000A70000-0x0000000000B40000-memory.dmp

Filesize
832KB

Download
memory/856-133-0x0000000005B50000-0x00000000060F4000-memory.dmp

Filesize
5.6MB

Download
memory/856-134-0x00000000055A0000-0x0000000005632000-memory.dmp

Filesize
584KB

Download
memory/856-135-0x0000000005680000-0x000000000568A000-memory.dmp

Filesize
40KB

Download
memory/856-136-0x00000000091B0000-0x000000000924C000-memory.dmp

Filesize
624KB

Download
memory/1324-137-0x0000000000000000-mapping.dmp

Download
memory/1440-138-0x0000000000000000-mapping.dmp

Download
memory/1440-139-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download