snakekeylogger | 57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25-10-2023 16:27

Target

2af24dbf80882f85fcb9b44324f915c6.exe
Size

280KB
MD5

2af24dbf80882f85fcb9b44324f915c6
SHA1

d9e77d1e4cfe4e086872b9b5b56a028733e38334
SHA256

57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800
SHA512

18347b6a48a6c97c74dcf99088347594c3a8684c2c99f1058d7c1b345240e8c1c4734b98727c089a19e0ce5910c18f4c5013e9aecf8975531253cb50cd63eec4
SSDEEP

6144:Oi6hMrvVvL6mqARyhHhnLiyTAbU3vWeq06zvyduQpxp0Un0QEai7uxnZgalZRndl:Oi6hMrvJLcuylhtAg3Oeq06zKduEb0U7

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2784-1-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-3-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-5-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-8-0x00000000003B0000-0x00000000003F0000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-11-0x00000000003B0000-0x00000000003F0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

2af24dbf80882f85fcb9b44324f915c6.exe

description pid process target process

PID 2408 set thread context of 2784 2408 2af24dbf80882f85fcb9b44324f915c6.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

2784 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

864 dw20.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2af24dbf80882f85fcb9b44324f915c6.exe

pid process

2408 2af24dbf80882f85fcb9b44324f915c6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2784 MSBuild.exe

description	pid	process	target process
PID 2408 set thread context of 2784	2408	2af24dbf80882f85fcb9b44324f915c6.exe	MSBuild.exe

pid	process
2784	MSBuild.exe

pid	process
864	dw20.exe

pid	process
2408	2af24dbf80882f85fcb9b44324f915c6.exe

description	pid	process
Token: SeDebugPrivilege	2784	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2af24dbf80882f85fcb9b44324f915c6.exeMSBuild.exe

description	pid	process	target process
PID 2408 wrote to memory of 2784	2408	2af24dbf80882f85fcb9b44324f915c6.exe	MSBuild.exe
PID 2408 wrote to memory of 2784	2408	2af24dbf80882f85fcb9b44324f915c6.exe	MSBuild.exe
PID 2408 wrote to memory of 2784	2408	2af24dbf80882f85fcb9b44324f915c6.exe	MSBuild.exe
PID 2408 wrote to memory of 2784	2408	2af24dbf80882f85fcb9b44324f915c6.exe	MSBuild.exe
PID 2408 wrote to memory of 2784	2408	2af24dbf80882f85fcb9b44324f915c6.exe	MSBuild.exe
PID 2784 wrote to memory of 864	2784	MSBuild.exe	dw20.exe
PID 2784 wrote to memory of 864	2784	MSBuild.exe	dw20.exe
PID 2784 wrote to memory of 864	2784	MSBuild.exe	dw20.exe
PID 2784 wrote to memory of 864	2784	MSBuild.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1496
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:864

memory/864-9-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/864-12-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/2408-0-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/2784-1-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2784-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2784-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2784-6-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-7-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-8-0x00000000003B0000-0x00000000003F0000-memory.dmp

Filesize
256KB

Download
memory/2784-10-0x00000000748F0000-0x0000000074E9B000-memory.dmp

Filesize
5.7MB

Download
memory/2784-11-0x00000000003B0000-0x00000000003F0000-memory.dmp

Filesize
256KB

Download