snakekeylogger | 76a7f3ea3965896cf16bc921fc73a4d3a85abb7a80125ba29e3c1088a4ae4d15

Analysis

max time kernel
38s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 17:03

Target

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe
Size

366KB
MD5

3c1ade1441ef11aed8496b742eab197b
SHA1

06ebde82c367791c03196888fb2fcc7721296564
SHA256

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738
SHA512

79f35c1f552040fd3f5273aa288bbcc86662a325dc9fd5c1817d127568a5edd3337c9b124583c3e09d07c446dcdc2b6b515227ec0d987b6b8444f342046715a6
SSDEEP

6144:L0nJBIKD2SJMz2dR8rZNlvzGSTo5xBB9VVh8YZWUBwDPlj3y4QTdk6ceh9X3P92D:sJfD2S+nRqx39Xh88VBIlzy4Qpk6ceXx

Score

10^/10

Family

snakekeylogger

https://api.telegram.org/bot6243209595:AAGECSmdSqJiVZcdFoBvotoaKcKT9Lz5Gvw/sendMessage?chat_id=1070926352

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4356-9-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 checkip.dyndns.org

flow	ioc
17	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe

description	pid	process	target process
PID 4132 set thread context of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

4356 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 4356 RegAsm.exe

pid	process
4356	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4356	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe

description	pid	process	target process
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe
PID 4132 wrote to memory of 4356	4132	16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738.exe	RegAsm.exe

memory/4132-6-0x0000000004EE0000-0x0000000004F7C000-memory.dmp

Filesize
624KB

Download
memory/4132-8-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/4132-2-0x0000000004BC0000-0x0000000004C14000-memory.dmp

Filesize
336KB

Download
memory/4132-3-0x00000000052B0000-0x0000000005854000-memory.dmp

Filesize
5.6MB

Download
memory/4132-4-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Filesize
584KB

Download
memory/4132-5-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/4132-1-0x0000000000240000-0x00000000002A2000-memory.dmp

Filesize
392KB

Download
memory/4132-7-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/4132-0-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/4132-11-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4356-12-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4356-13-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4356-14-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4356-15-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download