Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2023, 08:48

General

  • Target

    26f6b83f00ede490164483e6f396a7b4.exe

  • Size

    127KB

  • MD5

    26f6b83f00ede490164483e6f396a7b4

  • SHA1

    0f14bc46b93ddad1bf071b28b578e8489aaa3787

  • SHA256

    537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0

  • SHA512

    7aa0ad7b1b6d48bbb96b74619cba64cfdf4a7bce8fd0779b9dbd8927fb29a52b270150bb5086c20cbc0d883fef239d5f6f1ed4f7d68f696f64306bb327986f44

  • SSDEEP

    3072:VJemedcYJyJUq2YuVAbzoZObCp4IwBtXnbY:VeGVTumbbJ3b

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26f6b83f00ede490164483e6f396a7b4.exe
    "C:\Users\Admin\AppData\Local\Temp\26f6b83f00ede490164483e6f396a7b4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 1512
      2⤵
      • Program crash
      PID:1624

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2316-55-0x0000000074ED0000-0x00000000755BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2316-54-0x0000000000A70000-0x0000000000A96000-memory.dmp

          Filesize

          152KB

        • memory/2316-56-0x00000000049A0000-0x00000000049E0000-memory.dmp

          Filesize

          256KB

        • memory/2316-57-0x0000000074ED0000-0x00000000755BE000-memory.dmp

          Filesize

          6.9MB

        • memory/2316-58-0x00000000049A0000-0x00000000049E0000-memory.dmp

          Filesize

          256KB