snakekeylogger | 1fd1e0ff7b9e6bc7b9014cbdfa12b15459011086a2398185e5b51ca92bf8a8e5

Analysis

max time kernel
208s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2023, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance Slippdf.exe
Size 643KB
Sample230211-kqgdmscb39
SHA256 1fd1e0ff7b9e6bc7b9014cbdfa12b15459011086a2398185e5b51ca92bf8a8e5
MD5 e10f343a416da4b5a857fd22832098b7
SHA1 407394d8403553066ce56aa9fef56c3f388b7ac8
SHA512 63a328fda1d42c234dee28cc0140b88d290d31ccd326ea0ca2de5c1b3d61e2b18ce74f5bcffbd2091e490444ca6bb24730d6572c6e9d30428c27a104871eac39
SSDEEP 12288:ht4+SesURUn8qpn9THEakyztTm3bwCLXftnrk25vqNwZVQlQX:/8yUn82nZPlK1DJrMwZVQlQX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6195883082:AAGWny1eIdfdYY622YO2PWze7EejlyCvXto/sendMessage?chat_id=5224318672

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/456-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3184 set thread context of 456	3184	Remittance Slippdf.exe	81

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
456	Remittance Slippdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	Remittance Slippdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81
PID 3184 wrote to memory of 456	3184	Remittance Slippdf.exe	81

C:\Users\Admin\AppData\Local\Temp\Remittance Slippdf.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance Slippdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\Remittance Slippdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Remittance Slippdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Remittance Slippdf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Remittance Slippdf.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/456-138-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3184-132-0x0000000000E20000-0x0000000000EC6000-memory.dmp

Download

memory/3184-133-0x0000000005ED0000-0x0000000006474000-memory.dmp

Download

memory/3184-134-0x0000000005920000-0x00000000059B2000-memory.dmp

Download

memory/3184-135-0x0000000005860000-0x000000000586A000-memory.dmp

Download

memory/3184-136-0x0000000009200000-0x000000000929C000-memory.dmp

Download