snakekeylogger | 5704a693482f6acdedd64c7f3b51f4bb1b84d79b29e38c55724d59a866401e12

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 15:04

Target

47928899_9692545608_20230828_11218099.exe
Size

1.5MB
MD5

92efa77973c64d34e4e9ece2a72ce7ee
SHA1

dafa81235386e6a10f387ba4b61665119ad1235c
SHA256

00dd392927d9d236b9dc98f1fe174606ee9f51942a9ecd00b298331e2f5008ac
SHA512

9a6de5ee56d933b9ca9bb796800208135633cbc6ce7a131fa46d4a116764a35695136982ec6d5619245b22993bd22b3565a58d816522c4aaa01c4c0328d5384a
SSDEEP

49152:2FNO2aCN40TGhTyNaSp9rmapmTAadmRHhxQxdn8FgLOH:2FNOfCN40uyc4CLxdMBnFH

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/3380-2-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2488-0-0x00007FF770930000-0x00007FF770EDB000-memory.dmp	upx
behavioral2/memory/2488-3-0x00007FF770930000-0x00007FF770EDB000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2488 set thread context of 3380	2488	47928899_9692545608_20230828_11218099.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3380	jsc.exe
3380	jsc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	jsc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80
PID 2488 wrote to memory of 3380	2488	47928899_9692545608_20230828_11218099.exe	80

memory/2488-3-0x00007FF770930000-0x00007FF770EDB000-memory.dmp

Filesize
5.7MB

Download
memory/2488-1-0x0000026AF12C0000-0x0000026AF12D0000-memory.dmp

Filesize
64KB

Download
memory/2488-0-0x00007FF770930000-0x00007FF770EDB000-memory.dmp

Filesize
5.7MB

Download
memory/3380-6-0x00000000052A0000-0x000000000533C000-memory.dmp

Filesize
624KB

Download
memory/3380-4-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/3380-5-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/3380-2-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3380-7-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3380-8-0x0000000075390000-0x0000000075B40000-memory.dmp

Filesize
7.7MB

Download
memory/3380-9-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3380-10-0x0000000006570000-0x00000000065C0000-memory.dmp

Filesize
320KB

Download
memory/3380-11-0x0000000006790000-0x0000000006952000-memory.dmp

Filesize
1.8MB

Download
memory/3380-12-0x0000000006960000-0x00000000069F2000-memory.dmp

Filesize
584KB

Download
memory/3380-13-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download