snakekeylogger | 56256709f596532c266b723b263c3db71bb4b88d8051ade4fc83fc793b5f341e

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 07:21

Target

SCH09876568009876-098.exe
Size

356KB
MD5

a9d79ca8143f17ee3d17596b500676c2
SHA1

737af7ca98ab36041889940a3468f690549448be
SHA256

765daa6202872b486382897bb06f4e17522fc29173677ea38e6e3451c5fb5d3e
SHA512

f66cd53aa1d123b8ddf8e02e291d9cb08e43fed2d0b107be328799e55f33a4383b7715d50e6b89dbea0d08f9560232d579ee2f4ad4082d43645e2c7bc05f1c16
SSDEEP

6144:L0nJBIKD2SJMz2dR8rZNlvzB0CCadHT3+lo2iUSe7Ye8i9Sw3Kc50RxTlSdk6ce4:sJfD2S+nRBl/HCTi/hetSw3juPek6ceV

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2716-7-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral3/memory/2716-8-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 2164 WerFault.exe SCH09876568009876-098.exe

pid	pid_target	process	target process
2028	2164	WerFault.exe	SCH09876568009876-098.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SCH09876568009876-098.exe

description	pid	process	target process
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2716	2164	SCH09876568009876-098.exe	cvtres.exe
PID 2164 wrote to memory of 2028	2164	SCH09876568009876-098.exe	WerFault.exe
PID 2164 wrote to memory of 2028	2164	SCH09876568009876-098.exe	WerFault.exe
PID 2164 wrote to memory of 2028	2164	SCH09876568009876-098.exe	WerFault.exe
PID 2164 wrote to memory of 2028	2164	SCH09876568009876-098.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SCH09876568009876-098.exe
"C:\Users\Admin\AppData\Local\Temp\SCH09876568009876-098.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
2⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 620
2⤵
- Program crash
PID:2028

memory/2164-0-0x0000000000EF0000-0x0000000000F50000-memory.dmp

Filesize
384KB

Download
memory/2164-1-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-2-0x0000000000730000-0x0000000000784000-memory.dmp

Filesize
336KB

Download
memory/2164-3-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/2164-4-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/2164-9-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-10-0x0000000000CF0000-0x0000000000D30000-memory.dmp

Filesize
256KB

Download
memory/2716-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2716-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2716-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2716-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download