snakekeylogger | d20df43a0e3f672427f2dec2be68beda3e98a8a125d8bf5dc13c78ec385eb4a4

Analysis

max time kernel
187s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
10/12/2022, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Reciept_23828402472084pdf.exe
Size 756KB
Sample221210-prryzsfe63
SHA256 d20df43a0e3f672427f2dec2be68beda3e98a8a125d8bf5dc13c78ec385eb4a4
MD5 4ee7cba3c64e028c832b11d6c3660de2
SHA1 2271132521ba9c5299a109a3054fc157c96b4b78
SHA512 f19b90a6664c6958ed9337c22c5e67655e480403a0ed60b3c38c683fedb099294fa45c230a97e9f81de7b4aa9cc75fc2152a31cc97f8a3f6a291078827f51497
SSDEEP 12288:Bp6B2iNrAudTFrsSZ8Ez1HFN2ZsQP8x7o:BwB1JAEF5/N2/C7o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
qlRYaFn8
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2028-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 392 set thread context of 2028	392	Payment Reciept_23828402472084pdf.exe	87

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2028	Payment Reciept_23828402472084pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	Payment Reciept_23828402472084pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87
PID 392 wrote to memory of 2028	392	Payment Reciept_23828402472084pdf.exe	87

C:\Users\Admin\AppData\Local\Temp\Payment Reciept_23828402472084pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Reciept_23828402472084pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\Payment Reciept_23828402472084pdf.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Payment Reciept_23828402472084pdf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Reciept_23828402472084pdf.exe.log
Size 1KB
SHA256 e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
MD5 84e77a587d94307c0ac1357eb4d3d46f
SHA1 83cc900f9401f43d181207d64c5adba7a85edc1e
SHA512 aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
MD5 SHA1 SHA512

Submit Download

memory/392-132-0x0000000000A30000-0x0000000000AF4000-memory.dmp

Download

memory/392-133-0x0000000005C40000-0x00000000061E4000-memory.dmp

Download

memory/392-134-0x00000000054D0000-0x0000000005562000-memory.dmp

Download

memory/392-135-0x0000000005570000-0x000000000560C000-memory.dmp

Download

memory/392-136-0x0000000002F40000-0x0000000002F4A000-memory.dmp

Download

memory/2028-138-0x0000000000400000-0x0000000000426000-memory.dmp

Download