Analysis

  • max time kernel
    95s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2023, 03:44

General

  • Target

    SnakeKeylogger-main/bin/Release/Snake Keylogger.exe

  • Size

    6.0MB

  • MD5

    7d9c8e2d6d6bf957a1ebda127c084652

  • SHA1

    2ff3951d6b5113902fde10f484d31b8d35912baf

  • SHA256

    fd6e3c0c6a443a9872a082f02955ca8cf7bc7f42752fdc0fe01622a5d35d07bf

  • SHA512

    cda06d41880d1b23f086bfbec0fe19f3cd787b1fdd0e2d4a8f80747fb42b088ed7cbc456f8862b979b7c94b5f0ba313749797f998867fccf17482d947860c933

  • SSDEEP

    49152:Hus/0tGxAPbN34EG1nFCiQ9bozruSX0RIglO1CuL9VNcaCdGczKITh1fk1gkLF:Os0tGx7K6rt6MpChJCj

Malware Config

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Beds Protector Packer 1 IoCs

    Detects Beds Protector packer used to load .NET malware.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SnakeKeylogger-main\bin\Release\Snake Keylogger.exe
    "C:\Users\Admin\AppData\Local\Temp\SnakeKeylogger-main\bin\Release\Snake Keylogger.exe"
    1⤵
      PID:1304

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1304-133-0x0000000000BC0000-0x00000000011C4000-memory.dmp

      Filesize

      6.0MB

    • memory/1304-134-0x0000000003290000-0x00000000032E4000-memory.dmp

      Filesize

      336KB

    • memory/1304-135-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-136-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-137-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-138-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-139-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-140-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-141-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB

    • memory/1304-142-0x000000001D060000-0x000000001D070000-memory.dmp

      Filesize

      64KB