snakekeylogger | 4e985491cb31be89256f566fe21324cd19cd6cae37484139f9b7961fbca90915

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/04/2023, 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ 080323(MECH)NBIAP-23.pdf.exe
Size

531KB
MD5

ec02a67baefc47cfcd5e4a998c282c4b
SHA1

1865c77ab4fb1c950410373b60b477d254cf35f7
SHA256

4e985491cb31be89256f566fe21324cd19cd6cae37484139f9b7961fbca90915
SHA512

48e32ff985d9cb8c39a832f5672d8d52c7985868f6bd9c984f3d3a36331e9c721d4a10e31274c56a2239703b9ce01e399b2b620e2cbb6085c78dcd7d9a389776
SSDEEP

12288:fYSaGLF+rHV6NmHF6pUZBnuQcTvl2QN5BXejXPon3:ASaGLkDosHQabuQcTvLNzh

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6088403113:AAGbasJAZS1yXzT5Hv6KJBlt80Z5QJZiq8Y/sendMessage?chat_id=6128502729

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

resource	yara_rule
behavioral1/memory/580-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/580-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/580-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/580-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/580-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/580-71-0x0000000004830000-0x0000000004870000-memory.dmp	family_snakekeylogger
behavioral1/memory/580-72-0x0000000004830000-0x0000000004870000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
580	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28
PID 1692 wrote to memory of 580	1692	RFQ 080323(MECH)NBIAP-23.pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\RFQ 080323(MECH)NBIAP-23.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 080323(MECH)NBIAP-23.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/580-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/580-72-0x0000000004830000-0x0000000004870000-memory.dmp

Filesize
256KB

Download
memory/580-71-0x0000000004830000-0x0000000004870000-memory.dmp

Filesize
256KB

Download
memory/580-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/580-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/580-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/580-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/580-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/580-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1692-55-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1692-60-0x0000000000AB0000-0x0000000000AD8000-memory.dmp

Filesize
160KB

Download
memory/1692-54-0x0000000000DD0000-0x0000000000E5A000-memory.dmp

Filesize
552KB

Download
memory/1692-59-0x0000000004480000-0x00000000044E2000-memory.dmp

Filesize
392KB

Download
memory/1692-58-0x0000000000460000-0x000000000046C000-memory.dmp

Filesize
48KB

Download
memory/1692-57-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1692-56-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download