snakekeylogger | e1343230309f534e71d05bec01c79e23e701905012800ae2fd6ca1763ee7f994

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 11:53

Target

payment copy.exe
Size

632KB
MD5

9dc11bc9f45646da72f1fcd80ec3c8ef
SHA1

6238eec6748e70e2685e8c2b58e9cbc7e41898ca
SHA256

8ef5abf806b4399370b4c8a1ea4f0b87e995754b4594d751ba2648c55b71ad25
SHA512

efd10d089aead06fe4dd841716f5348e94ce26fbf3b084a9345de28b88a79cb903a7ae7372378ed6ce6bd530eae739814df1b0d009bc2f5448168fddf50a9946
SSDEEP

12288:pM9Dgh/PsZ1DX/VDJUS79oddN1hluiiahnUv+tECuLWJ:0Dgh/P7SQdDJ/hUG2Vi

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/216-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

payment copy.exe

description pid process target process

PID 5056 set thread context of 216 5056 payment copy.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

payment copy.exeRegSvcs.exe

pid process

5056 payment copy.exe
5056 payment copy.exe
216 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

payment copy.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 5056 payment copy.exe
Token: SeDebugPrivilege 216 RegSvcs.exe

flow	ioc
29	checkip.dyndns.org

description	pid	process	target process
PID 5056 set thread context of 216	5056	payment copy.exe	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	5056	payment copy.exe
Token: SeDebugPrivilege	216	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

payment copy.exe

description	pid	process	target process
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe
PID 5056 wrote to memory of 216	5056	payment copy.exe	RegSvcs.exe

memory/216-137-0x0000000000000000-mapping.dmp

Download
memory/216-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/5056-132-0x0000000000D30000-0x0000000000DD4000-memory.dmp

Filesize
656KB

Download
memory/5056-133-0x0000000005D60000-0x0000000006304000-memory.dmp

Filesize
5.6MB

Download
memory/5056-134-0x00000000057B0000-0x0000000005842000-memory.dmp

Filesize
584KB

Download
memory/5056-135-0x0000000005760000-0x000000000576A000-memory.dmp

Filesize
40KB

Download
memory/5056-136-0x00000000080E0000-0x000000000817C000-memory.dmp

Filesize
624KB

Download