snakekeylogger | 29a028df9898f4d21557863d584879c54b759de951022a419cb4b2b6b40a87bf

Analysis

max time kernel
182s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 11:27

Target

final INV, PL, BL..exe
Size

223KB
MD5

80b48131a8ee8130588c6e8915905a4a
SHA1

29493397e53171528e9587581b750ac85333c174
SHA256

29a028df9898f4d21557863d584879c54b759de951022a419cb4b2b6b40a87bf
SHA512

d2511b3014689e11ebb18ec18eb1dfd64b86b00d2acc114ab3360b8b575c4d1942883f62b2123b5b737b9f95a822a849616b9f3c7fab4f0e7c0ece75a231ba23
SSDEEP

3072:DA4CFu2f+4KMKXk0Q9gsYDDAJmGIrmMvSh3/BxYrOW5qmHohiFQQbTgjnIPX3XgE:E4sL+GKXk0F+IRXM+/5DohiyQ+yI4

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/3784-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/3784-138-0x0000000000400000-0x0000000000426000-memory.dmp	family_stormkitty

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4764 set thread context of 3784	4764	final INV, PL, BL..exe	82

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1668	3784	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3784	final INV, PL, BL..exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3784	final INV, PL, BL..exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 740	4764	final INV, PL, BL..exe	80
PID 4764 wrote to memory of 740	4764	final INV, PL, BL..exe	80
PID 4764 wrote to memory of 740	4764	final INV, PL, BL..exe	80
PID 4764 wrote to memory of 2904	4764	final INV, PL, BL..exe	81
PID 4764 wrote to memory of 2904	4764	final INV, PL, BL..exe	81
PID 4764 wrote to memory of 2904	4764	final INV, PL, BL..exe	81
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82
PID 4764 wrote to memory of 3784	4764	final INV, PL, BL..exe	82

C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe
"C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe
  "C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe"
  2⤵
  PID:740
- C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe
  "C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe"
  2⤵
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe
  "C:\Users\Admin\AppData\Local\Temp\final INV, PL, BL..exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 1536
    3⤵
    - Program crash
    PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3784 -ip 3784
1⤵
PID:2968

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\final INV, PL, BL..exe.log

Filesize
617B

MD5
99e770c0d4043aa84ef3d3cbc7723c25

SHA1
19829c5c413fccba750a3357f938dfa94486acad

SHA256
33c7dd4c852dae6462c701337f8e0a8647602847ccaee656fa6f1149cccfb5d5

SHA512
ba521e2f57d7e1db19445201948caa7af6d953e1c1340228934888f8ec05b8984ad492122d0bf0550b5e679614d8a713ecf68f91916ffa6e5d8f75bf003aae39

Download Submit
memory/3784-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3784-141-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/3784-142-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4764-134-0x0000000000210000-0x000000000024E000-memory.dmp

Filesize
248KB

Download
memory/4764-135-0x0000000004CF0000-0x0000000004D8C000-memory.dmp

Filesize
624KB

Download
memory/4764-136-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/4764-137-0x0000000005340000-0x00000000058E4000-memory.dmp

Filesize
5.6MB

Download