snakekeylogger | e51cde73b2f4b0b897843235d5db557cbdcd41f3e5b4c2a4c31886b95e5301d4

Analysis

max time kernel
209s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

231009-001-FACTURA.exe
Size

530KB
MD5

d5cf794b8931228454a9218eba67c8c6
SHA1

c58237c6e67e028bccaac59d4fb6791bf8ed646f
SHA256

e51cde73b2f4b0b897843235d5db557cbdcd41f3e5b4c2a4c31886b95e5301d4
SHA512

c876b50f51c473755275fbf2972f4748ba9192ff6d07bd099bf0c2766678e75a7c8e921d878e2601acd2b67cd4885bc30b7298d8896a78a595364f0eef7ff483
SSDEEP

12288:ob7s9TQ9WseH/0px4aPQqyYxe8Bxm78xlaGgci:c7s90EHu7t3xPiWyT

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot6454266704:AAGc7MbDFOw3VJ52r1hPLsjSZvjH8GUmylk/sendMessage?chat_id=1467583453

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1596-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

231009-001-FACTURA.exe

description pid process target process

PID 4064 set thread context of 1596 4064 231009-001-FACTURA.exe 231009-001-FACTURA.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

231009-001-FACTURA.exe

pid process

1596 231009-001-FACTURA.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

231009-001-FACTURA.exe

description pid process

Token: SeDebugPrivilege 1596 231009-001-FACTURA.exe

description	pid	process	target process
PID 4064 set thread context of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe

pid	process
1596	231009-001-FACTURA.exe

description	pid	process
Token: SeDebugPrivilege	1596	231009-001-FACTURA.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

231009-001-FACTURA.exe

description	pid	process	target process
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe
PID 4064 wrote to memory of 1596	4064	231009-001-FACTURA.exe	231009-001-FACTURA.exe

C:\Users\Admin\AppData\Local\Temp\231009-001-FACTURA.exe
"C:\Users\Admin\AppData\Local\Temp\231009-001-FACTURA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4064

C:\Users\Admin\AppData\Local\Temp\231009-001-FACTURA.exe
"C:\Users\Admin\AppData\Local\Temp\231009-001-FACTURA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1596-17-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/1596-15-0x0000000005440000-0x0000000005450000-memory.dmp

Filesize
64KB

Download
memory/1596-13-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4064-4-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/4064-5-0x0000000005210000-0x000000000521A000-memory.dmp

Filesize
40KB

Download
memory/4064-6-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4064-7-0x0000000005160000-0x0000000005170000-memory.dmp

Filesize
64KB

Download
memory/4064-8-0x0000000006820000-0x0000000006838000-memory.dmp

Filesize
96KB

Download
memory/4064-9-0x0000000000D10000-0x0000000000D20000-memory.dmp

Filesize
64KB

Download
memory/4064-10-0x00000000011E0000-0x0000000001240000-memory.dmp

Filesize
384KB

Download
memory/4064-11-0x00000000065B0000-0x000000000664C000-memory.dmp

Filesize
624KB

Download
memory/4064-0-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4064-3-0x0000000005280000-0x0000000005312000-memory.dmp

Filesize
584KB

Download
memory/4064-2-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/4064-16-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4064-1-0x00000000007A0000-0x000000000082A000-memory.dmp

Filesize
552KB

Download