snakekeylogger | ad408414cfc70cdc2f0a28d95130cde8931e694f39699aa4dce91a8cc30a0897

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2023, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO3420056.exe
Size 1.2MB
Sample230220-te21msbe87
SHA256 ad408414cfc70cdc2f0a28d95130cde8931e694f39699aa4dce91a8cc30a0897
MD5 e05427b2d5926de0d5183c7fbf32ca99
SHA1 b3530d54a0a78d814f279b133329ce6005fd6e32
SHA512 d494d729477dcdf0be5bc9f4c1d5dbf25085f396399c9e75d95758051c8a127c5dd089fa2ebcffbfabc5b4b995d935f429b3ea2aaeb9d999de303881db557559
SSDEEP 24576:5n/4yZ1qeokQIncACeUfwkN9RAzOG5rYE:VXkkQInNCwqAwE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5310184099:AAGxqu0IL8tjOF6Eq6x2u0gfcHhvuxRwfLU/sendMessage?chat_id=5350445922

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2340-139-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 2340	1632	PO3420056.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3644	2340	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1632	PO3420056.exe
1632	PO3420056.exe
2340	PO3420056.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	PO3420056.exe
Token: SeDebugPrivilege	2340	PO3420056.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1960	1632	PO3420056.exe	88
PID 1632 wrote to memory of 1960	1632	PO3420056.exe	88
PID 1632 wrote to memory of 1960	1632	PO3420056.exe	88
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89
PID 1632 wrote to memory of 2340	1632	PO3420056.exe	89

C:\Users\Admin\AppData\Local\Temp\PO3420056.exe
"C:\Users\Admin\AppData\Local\Temp\PO3420056.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\PO3420056.exe
  "C:\Users\Admin\AppData\Local\Temp\PO3420056.exe"
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\PO3420056.exe
  "C:\Users\Admin\AppData\Local\Temp\PO3420056.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1504
    3⤵
    - Program crash
    PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2340 -ip 2340
1⤵
PID:1812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

PO3420056.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO3420056.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/1632-132-0x0000000000670000-0x00000000007B4000-memory.dmp

Download

memory/1632-133-0x0000000005670000-0x0000000005C14000-memory.dmp

Download

memory/1632-134-0x0000000005160000-0x00000000051F2000-memory.dmp

Download

memory/1632-135-0x0000000005200000-0x000000000520A000-memory.dmp

Download

memory/1632-136-0x0000000008C70000-0x0000000008D0C000-memory.dmp

Download

memory/2340-139-0x0000000000400000-0x0000000000426000-memory.dmp

Download