Malware Analysis Report

2025-08-05 12:54

Sample ID 230805-lwmnaacf71
Target d8a5317c8c4e740557a01574cfebf71f.exe
SHA256 c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059
Tags
snakekeylogger keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c92819a5b69535e455893801e3ceabc29f5659a213ff93d4891b36c8af740059

Threat Level: Known bad

The file d8a5317c8c4e740557a01574cfebf71f.exe was found to be: Known bad.

Malicious Activity Summary

snakekeylogger keylogger spyware stealer

Snake Keylogger

Snake Keylogger payload

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-05 09:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-05 09:53

Reported

2023-08-05 09:55

Platform

win7-20230712-en

Max time kernel

117s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2568 set thread context of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2568 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 2568 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

"C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oefbENy.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oefbENy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CD0.tmp"

C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

"C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
DE 193.122.6.168:80 checkip.dyndns.org tcp

Files

memory/2568-53-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/2568-54-0x0000000001040000-0x0000000001102000-memory.dmp

memory/2568-55-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

memory/2568-56-0x0000000000490000-0x00000000004A2000-memory.dmp

memory/2568-57-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/2568-58-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

memory/2568-59-0x0000000000500000-0x0000000000508000-memory.dmp

memory/2568-60-0x0000000000510000-0x000000000051A000-memory.dmp

memory/2568-61-0x0000000005AB0000-0x0000000005B10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp5CD0.tmp

MD5 a09c26b52d208d4978e25e7ab911ce31
SHA1 26b2d98b4b87b6b22de634899bb1214fb0c02375
SHA256 f6878e7213ad770c458a2eee72c0e09082d2a2338fc5abb5c1d70b8ef8271fae
SHA512 f2163f2202b2aa1500700bfc3de1d33f5b4db164d89049bc655ff604098a83e387b8d164ff4fd29af7fada99dc3498f14a3061ad2e5f0bf09774a38194eaa9ec

memory/1616-67-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1616-68-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1616-69-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1616-70-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1616-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1616-73-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1616-75-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1616-77-0x0000000000400000-0x0000000000426000-memory.dmp

memory/2568-78-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/1616-79-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/1616-82-0x0000000000940000-0x0000000000980000-memory.dmp

memory/2788-83-0x0000000070450000-0x00000000709FB000-memory.dmp

memory/2788-84-0x0000000070450000-0x00000000709FB000-memory.dmp

memory/2788-85-0x00000000025C0000-0x0000000002600000-memory.dmp

memory/2788-86-0x00000000025C0000-0x0000000002600000-memory.dmp

memory/2788-87-0x0000000070450000-0x00000000709FB000-memory.dmp

memory/1616-88-0x00000000746A0000-0x0000000074D8E000-memory.dmp

memory/1616-89-0x0000000000940000-0x0000000000980000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-05 09:53

Reported

2023-08-05 09:55

Platform

win10v2004-20230703-en

Max time kernel

142s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3788 set thread context of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3788 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3788 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3788 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3788 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 3788 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 3788 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Windows\SysWOW64\schtasks.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe
PID 3788 wrote to memory of 1236 N/A C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

"C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oefbENy.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oefbENy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp"

C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe

"C:\Users\Admin\AppData\Local\Temp\d8a5317c8c4e740557a01574cfebf71f.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 158.101.44.242:80 checkip.dyndns.org tcp
US 8.8.8.8:53 242.44.101.158.in-addr.arpa udp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

memory/3788-133-0x0000000074890000-0x0000000075040000-memory.dmp

memory/3788-134-0x0000000000A90000-0x0000000000B52000-memory.dmp

memory/3788-135-0x0000000005AF0000-0x0000000006094000-memory.dmp

memory/3788-136-0x0000000005540000-0x00000000055D2000-memory.dmp

memory/3788-137-0x00000000056C0000-0x00000000056D0000-memory.dmp

memory/3788-138-0x00000000055F0000-0x00000000055FA000-memory.dmp

memory/3788-139-0x0000000074890000-0x0000000075040000-memory.dmp

memory/3788-140-0x00000000056C0000-0x00000000056D0000-memory.dmp

memory/3788-141-0x00000000082A0000-0x000000000833C000-memory.dmp

memory/1644-146-0x0000000002600000-0x0000000002636000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp27C7.tmp

MD5 5b56d9b86e4027454cd47e5c13506682
SHA1 c43745f1a72bc879dc6ffa335e41f416e6bd3bff
SHA256 7fbc99891fe2af9639d0fc6d6f377314b14b4924acd16963a79af1e736d5cf63
SHA512 d8d9753ecc0e7ee62cc4ac74283848d1161b4e0333dd705fb15290d1757af329671b64bf2d1366963aa20447aa3bc9d122f28ae7da4b0de2e8fad0178205a594

memory/1644-148-0x0000000074890000-0x0000000075040000-memory.dmp

memory/1644-149-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/1236-150-0x0000000000400000-0x0000000000426000-memory.dmp

memory/1644-151-0x0000000005140000-0x0000000005768000-memory.dmp

memory/1644-152-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/1236-154-0x0000000074890000-0x0000000075040000-memory.dmp

memory/3788-155-0x0000000074890000-0x0000000075040000-memory.dmp

memory/1236-156-0x00000000057D0000-0x00000000057E0000-memory.dmp

memory/1644-157-0x00000000057A0000-0x00000000057C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvh3f1tp.ii4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1644-164-0x00000000058B0000-0x0000000005916000-memory.dmp

memory/1644-160-0x0000000005840000-0x00000000058A6000-memory.dmp

memory/1644-169-0x0000000005F10000-0x0000000005F2E000-memory.dmp

memory/1644-170-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/1644-171-0x00000000064D0000-0x0000000006502000-memory.dmp

memory/1644-172-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/1644-182-0x00000000064B0000-0x00000000064CE000-memory.dmp

memory/1644-183-0x0000000007840000-0x0000000007EBA000-memory.dmp

memory/1644-184-0x0000000007200000-0x000000000721A000-memory.dmp

memory/1644-185-0x0000000007270000-0x000000000727A000-memory.dmp

memory/1644-186-0x0000000074890000-0x0000000075040000-memory.dmp

memory/1644-187-0x0000000007480000-0x0000000007516000-memory.dmp

memory/1236-188-0x0000000006C00000-0x0000000006DC2000-memory.dmp

memory/1644-189-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/1644-190-0x0000000004B00000-0x0000000004B10000-memory.dmp

memory/1644-191-0x0000000007430000-0x000000000743E000-memory.dmp

memory/1644-192-0x0000000007540000-0x000000000755A000-memory.dmp

memory/1644-193-0x0000000007520000-0x0000000007528000-memory.dmp

memory/1236-196-0x0000000074890000-0x0000000075040000-memory.dmp

memory/1644-197-0x0000000074890000-0x0000000075040000-memory.dmp

memory/1236-198-0x00000000057D0000-0x00000000057E0000-memory.dmp