snakekeylogger | 5b67a54df45cc6e181388808f9cb35b0c2660d27b895889da37938408fe22072

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/05/2023, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Halkbank_Ekstre_20230516_0819705_452378.pdf.exe
Size

853KB
MD5

58d456f97f54cfda39bd01159fa5795c
SHA1

ee224f8e2a01b12aff75c22414f835b4b530dfb0
SHA256

5b67a54df45cc6e181388808f9cb35b0c2660d27b895889da37938408fe22072
SHA512

736d3f96b95a268ef1bf38e17d08100209c07fc1eb82244e9aef6e574afec5c2ce004173ed3973866a037f1fe68d8a681d5c071bdd6f4c944b836fe38002cc69
SSDEEP

12288:gv51Z2pNKbO4NW87Jz4XPD4ukjuZM/LBxKQIZjU:cPZ2pgbOKx4XL4MZM/LP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot1513074805:AAE9QtTNfInovOlDzP4PcE-Ro12KxYiz9Z4/sendMessage?chat_id=1673719962

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

resource	yara_rule
behavioral1/memory/1196-63-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1196-64-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1196-66-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1196-68-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1196-70-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/1196-71-0x0000000004C30000-0x0000000004C70000-memory.dmp	family_snakekeylogger
behavioral1/memory/1196-72-0x0000000004C30000-0x0000000004C70000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1124 set thread context of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1196	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28
PID 1124 wrote to memory of 1196	1124	Halkbank_Ekstre_20230516_0819705_452378.pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20230516_0819705_452378.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20230516_0819705_452378.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20230516_0819705_452378.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20230516_0819705_452378.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-54-0x00000000010F0000-0x00000000011CC000-memory.dmp

Filesize
880KB

Download
memory/1124-55-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/1124-56-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1124-57-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/1124-58-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/1124-59-0x0000000004AC0000-0x0000000004B22000-memory.dmp

Filesize
392KB

Download
memory/1124-60-0x0000000000E70000-0x0000000000E98000-memory.dmp

Filesize
160KB

Download
memory/1196-61-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-62-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-63-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-64-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1196-66-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-68-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-70-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1196-71-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download
memory/1196-72-0x0000000004C30000-0x0000000004C70000-memory.dmp

Filesize
256KB

Download