snakekeylogger | 56256709f596532c266b723b263c3db71bb4b88d8051ade4fc83fc793b5f341e

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 10:36

Target

SCH09876568009876-098.exe
Size

356KB
MD5

a9d79ca8143f17ee3d17596b500676c2
SHA1

737af7ca98ab36041889940a3468f690549448be
SHA256

765daa6202872b486382897bb06f4e17522fc29173677ea38e6e3451c5fb5d3e
SHA512

f66cd53aa1d123b8ddf8e02e291d9cb08e43fed2d0b107be328799e55f33a4383b7715d50e6b89dbea0d08f9560232d579ee2f4ad4082d43645e2c7bc05f1c16
SSDEEP

6144:L0nJBIKD2SJMz2dR8rZNlvzB0CCadHT3+lo2iUSe7Ye8i9Sw3Kc50RxTlSdk6ce4:sJfD2S+nRBl/HCTi/hetSw3juPek6ceV

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1724-7-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral3/memory/1724-8-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2152 2224 WerFault.exe SCH09876568009876-098.exe

pid	pid_target	process	target process
2152	2224	WerFault.exe	SCH09876568009876-098.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SCH09876568009876-098.exe

description	pid	process	target process
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 1724	2224	SCH09876568009876-098.exe	cvtres.exe
PID 2224 wrote to memory of 2152	2224	SCH09876568009876-098.exe	WerFault.exe
PID 2224 wrote to memory of 2152	2224	SCH09876568009876-098.exe	WerFault.exe
PID 2224 wrote to memory of 2152	2224	SCH09876568009876-098.exe	WerFault.exe
PID 2224 wrote to memory of 2152	2224	SCH09876568009876-098.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SCH09876568009876-098.exe
"C:\Users\Admin\AppData\Local\Temp\SCH09876568009876-098.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
2⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 620
2⤵
- Program crash
PID:2152

memory/1724-6-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1724-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1724-5-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1724-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2224-0-0x0000000000100000-0x0000000000160000-memory.dmp

Filesize
384KB

Download
memory/2224-1-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-2-0x00000000006E0000-0x0000000000734000-memory.dmp

Filesize
336KB

Download
memory/2224-3-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/2224-4-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/2224-9-0x0000000074460000-0x0000000074B4E000-memory.dmp

Filesize
6.9MB

Download