Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/08/2023, 18:04

General

  • Target

    537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe

  • Size

    127KB

  • MD5

    26f6b83f00ede490164483e6f396a7b4

  • SHA1

    0f14bc46b93ddad1bf071b28b578e8489aaa3787

  • SHA256

    537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0

  • SHA512

    7aa0ad7b1b6d48bbb96b74619cba64cfdf4a7bce8fd0779b9dbd8927fb29a52b270150bb5086c20cbc0d883fef239d5f6f1ed4f7d68f696f64306bb327986f44

  • SSDEEP

    3072:VJemedcYJyJUq2YuVAbzoZObCp4IwBtXnbY:VeGVTumbbJ3b

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\537c0fa08dd7d6f12163ff4d0f14f5732018da9c9f0b783b99565821fa4840f0exe_JC.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1844
      2⤵
      • Program crash
      PID:4920
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4368 -ip 4368
    1⤵
      PID:1416

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4368-133-0x00000000002C0000-0x00000000002E6000-memory.dmp

            Filesize

            152KB

          • memory/4368-134-0x0000000075030000-0x00000000757E0000-memory.dmp

            Filesize

            7.7MB

          • memory/4368-135-0x00000000052A0000-0x0000000005844000-memory.dmp

            Filesize

            5.6MB

          • memory/4368-136-0x0000000004BE0000-0x0000000004C7C000-memory.dmp

            Filesize

            624KB

          • memory/4368-137-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

            Filesize

            64KB

          • memory/4368-138-0x0000000075030000-0x00000000757E0000-memory.dmp

            Filesize

            7.7MB