snakekeylogger | a80035a72f24576683f6f490a4e8c9b94998aba882430227f2f201ad845cdbd4

Analysis

max time kernel
164s
max time network
189s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 16:44

Target

NEAS.6d427013d7c28c435ca95888dff8bee0.exe
Size

279KB
MD5

6d427013d7c28c435ca95888dff8bee0
SHA1

bbba700e65165aec00e672e57aadb460b41ef4b7
SHA256

a80035a72f24576683f6f490a4e8c9b94998aba882430227f2f201ad845cdbd4
SHA512

af5d15495fde3281cd116e9b0a43f593f11643942abf0def7046e03bd10cb9eedf706e00de4a3a8b3473a50634451d2a7feed940de92aa0e7e56d4abae6207a3
SSDEEP

6144:Bi6hMrvVvL6mqARyhHhnLiyTAbU3vWeq06zvyduQpxp0Un0QEai7uxnZgalZRndl:Bi6hMrvJLcuylhtAg3Oeq06zKduEb0U7

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2784-1-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-3-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-5-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-8-0x0000000000D90000-0x0000000000DD0000-memory.dmp	family_snakekeylogger
behavioral1/memory/2784-11-0x0000000000D90000-0x0000000000DD0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.6d427013d7c28c435ca95888dff8bee0.exe

description pid process target process

PID 2740 set thread context of 2784 2740 NEAS.6d427013d7c28c435ca95888dff8bee0.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

2784 MSBuild.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

2668 dw20.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

NEAS.6d427013d7c28c435ca95888dff8bee0.exe

pid process

2740 NEAS.6d427013d7c28c435ca95888dff8bee0.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2784 MSBuild.exe

description	pid	process	target process
PID 2740 set thread context of 2784	2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe	MSBuild.exe

pid	process
2784	MSBuild.exe

pid	process
2668	dw20.exe

pid	process
2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe

description	pid	process
Token: SeDebugPrivilege	2784	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

NEAS.6d427013d7c28c435ca95888dff8bee0.exeMSBuild.exe

description	pid	process	target process
PID 2740 wrote to memory of 2784	2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe	MSBuild.exe
PID 2740 wrote to memory of 2784	2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe	MSBuild.exe
PID 2740 wrote to memory of 2784	2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe	MSBuild.exe
PID 2740 wrote to memory of 2784	2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe	MSBuild.exe
PID 2740 wrote to memory of 2784	2740	NEAS.6d427013d7c28c435ca95888dff8bee0.exe	MSBuild.exe
PID 2784 wrote to memory of 2668	2784	MSBuild.exe	dw20.exe
PID 2784 wrote to memory of 2668	2784	MSBuild.exe	dw20.exe
PID 2784 wrote to memory of 2668	2784	MSBuild.exe	dw20.exe
PID 2784 wrote to memory of 2668	2784	MSBuild.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1508
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2668

memory/2668-12-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2668-13-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2740-0-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2784-1-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2784-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2784-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2784-6-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2784-7-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2784-8-0x0000000000D90000-0x0000000000DD0000-memory.dmp

Filesize
256KB

Download
memory/2784-9-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2784-10-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/2784-11-0x0000000000D90000-0x0000000000DD0000-memory.dmp

Filesize
256KB

Download