Analysis

  • max time kernel
    118s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2023, 08:48

General

  • Target

    26f6b83f00ede490164483e6f396a7b4.exe

  • Size

    127KB

  • MD5

    26f6b83f00ede490164483e6f396a7b4

  • SHA1

    0f14bc46b93ddad1bf071b28b578e8489aaa3787

  • SHA256

    537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0

  • SHA512

    7aa0ad7b1b6d48bbb96b74619cba64cfdf4a7bce8fd0779b9dbd8927fb29a52b270150bb5086c20cbc0d883fef239d5f6f1ed4f7d68f696f64306bb327986f44

  • SSDEEP

    3072:VJemedcYJyJUq2YuVAbzoZObCp4IwBtXnbY:VeGVTumbbJ3b

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26f6b83f00ede490164483e6f396a7b4.exe
    "C:\Users\Admin\AppData\Local\Temp\26f6b83f00ede490164483e6f396a7b4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 1836
      2⤵
      • Program crash
      PID:2472
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4956 -ip 4956
    1⤵
      PID:4840

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4956-133-0x0000000000D30000-0x0000000000D56000-memory.dmp

            Filesize

            152KB

          • memory/4956-134-0x0000000074EE0000-0x0000000075690000-memory.dmp

            Filesize

            7.7MB

          • memory/4956-135-0x0000000005CB0000-0x0000000006254000-memory.dmp

            Filesize

            5.6MB

          • memory/4956-136-0x00000000057A0000-0x000000000583C000-memory.dmp

            Filesize

            624KB

          • memory/4956-137-0x0000000005A70000-0x0000000005A80000-memory.dmp

            Filesize

            64KB

          • memory/4956-138-0x0000000074EE0000-0x0000000075690000-memory.dmp

            Filesize

            7.7MB

          • memory/4956-139-0x0000000005A70000-0x0000000005A80000-memory.dmp

            Filesize

            64KB

          • memory/4956-140-0x0000000074EE0000-0x0000000075690000-memory.dmp

            Filesize

            7.7MB