snakekeylogger | b89e8f3de3d92b9ec769868940302c5bc1255139307a2fc2caf4195fbe94a9f4

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
27-10-2023 01:19

Target

57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe
Size

280KB
MD5

2af24dbf80882f85fcb9b44324f915c6
SHA1

d9e77d1e4cfe4e086872b9b5b56a028733e38334
SHA256

57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800
SHA512

18347b6a48a6c97c74dcf99088347594c3a8684c2c99f1058d7c1b345240e8c1c4734b98727c089a19e0ce5910c18f4c5013e9aecf8975531253cb50cd63eec4
SSDEEP

6144:Oi6hMrvVvL6mqARyhHhnLiyTAbU3vWeq06zvyduQpxp0Un0QEai7uxnZgalZRndl:Oi6hMrvJLcuylhtAg3Oeq06zKduEb0U7

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2272-1-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2272-3-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2272-5-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe

description	pid	process	target process
PID 2244 set thread context of 2272	2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

2272 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

2644 dw20.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe

pid process

2244 57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2272 MSBuild.exe

pid	process
2272	MSBuild.exe

pid	process
2644	dw20.exe

pid	process
2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe

description	pid	process
Token: SeDebugPrivilege	2272	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exeMSBuild.exe

description	pid	process	target process
PID 2244 wrote to memory of 2272	2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe	MSBuild.exe
PID 2244 wrote to memory of 2272	2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe	MSBuild.exe
PID 2244 wrote to memory of 2272	2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe	MSBuild.exe
PID 2244 wrote to memory of 2272	2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe	MSBuild.exe
PID 2244 wrote to memory of 2272	2244	57026ff81a3a9033eaf856d3b36a72d12e613e5227b7740abe4ccca6e95e1800.exe	MSBuild.exe
PID 2272 wrote to memory of 2644	2272	MSBuild.exe	dw20.exe
PID 2272 wrote to memory of 2644	2272	MSBuild.exe	dw20.exe
PID 2272 wrote to memory of 2644	2272	MSBuild.exe	dw20.exe
PID 2272 wrote to memory of 2644	2272	MSBuild.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1500
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2644

memory/2244-0-0x0000000000280000-0x0000000000282000-memory.dmp

Filesize
8KB

Download
memory/2272-1-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2272-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2272-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2272-6-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/2272-7-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/2272-8-0x0000000000B90000-0x0000000000BD0000-memory.dmp

Filesize
256KB

Download
memory/2272-10-0x00000000743D0000-0x000000007497B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-9-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download
memory/2644-11-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download