snakekeylogger | 12cb7bbf9a1795a33f24e45ab2147d8e1f1dbcd5d26feb6ac5a27f228bed61dc

Analysis

max time kernel
190s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2023, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO #4500082142.exe
Size 854KB
Sample230511-w52tnsha99
SHA256 12cb7bbf9a1795a33f24e45ab2147d8e1f1dbcd5d26feb6ac5a27f228bed61dc
MD5 f88b8f27a17ab6a5a0ccec4d6420e0b9
SHA1 ab35bbcbdcd52f5d6d1e7d002f5bbccec5bfd642
SHA512 6063d866cd71c2581180eef7f876f771c53c69fe96880bcb29fc8110173d6dd0d6516412c6e45c5950558631c1c0bd6a19ea7c92fff37df73f9baa4e1b1f817e
SSDEEP 12288:3qU08m7DQ8ecGNKeA5xFKYeO4LNDWfgqQ4loQutTHcwBuxN:/vmPRKKlxQYrqNWgwo7Tc0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot5478319803:AAHq9LkDUFBRvjOub4YfRlPURZxM59_BVnc/sendMessage?chat_id=5516439768

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/620-140-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4008 set thread context of 620	4008	PO #4500082142.exe	98

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
620	PO #4500082142.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	620	PO #4500082142.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98
PID 4008 wrote to memory of 620	4008	PO #4500082142.exe	98

C:\Users\Admin\AppData\Local\Temp\PO #4500082142.exe
"C:\Users\Admin\AppData\Local\Temp\PO #4500082142.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\PO #4500082142.exe
  "C:\Users\Admin\AppData\Local\Temp\PO #4500082142.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-140-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/620-142-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/620-143-0x0000000005C50000-0x0000000005C60000-memory.dmp

Download

memory/4008-133-0x0000000000D40000-0x0000000000E1C000-memory.dmp

Download

memory/4008-134-0x0000000005E70000-0x0000000006414000-memory.dmp

Download

memory/4008-135-0x00000000058C0000-0x0000000005952000-memory.dmp

Download

memory/4008-136-0x0000000005830000-0x0000000005840000-memory.dmp

Download

memory/4008-137-0x00000000057D0000-0x00000000057DA000-memory.dmp

Download

memory/4008-138-0x0000000005830000-0x0000000005840000-memory.dmp

Download

memory/4008-139-0x0000000008720000-0x00000000087BC000-memory.dmp

Download