snakekeylogger | 92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024

Analysis

max time kernel
199s
max time network
222s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 10:30

Target

NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
Size

365KB
MD5

6e5fe2e8102810fa8c41e1708f5bad37
SHA1

866abdd7b659a470079b2cebb8c1e375a14dfe81
SHA256

92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024
SHA512

4e48fc62c0cf63b65ec427f1e759e1d0e07762a9fc7bb2601e9efadbe1de3e185de62a00fb30ac9445cf5d638f02d7ed99d3b74a68f59cbc8db5bd0d17db2494
SSDEEP

6144:CAY8QgjLjLzmfTi0rueeKeUnj+ZhcqCgT+0aRrqYsGdh1BiOFnAx:RXi7fr5e9DkqCgy0uOxc3BiOFI

Score

10^/10

Family

snakekeylogger

https://api.telegram.org/bot6791427761:AAEq2ybkfsfQ4vvX1WVwRKr-rekQ-dk6jcM/sendMessage?chat_id=6443825857

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4788-8-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

description	pid	process	target process
PID 3928 set thread context of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1644 4788 WerFault.exe NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

pid process

4788 NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

pid	pid_target	process	target process
1644	4788	WerFault.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

pid	process
4788	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

description	pid	process	target process
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
PID 3928 wrote to memory of 4788	3928	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe	NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
C:\Users\Admin\AppData\Local\Temp\NEAS.92bd760ecd8223c94862932a852fba8f1c386f5eb1eeaf6e88da948baa10c024.exe
2⤵
- Suspicious use of UnmapMainImage
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 12
3⤵
- Program crash
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4788 -ip 4788
1⤵
PID:1976

memory/3928-1-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/3928-0-0x00000000005C0000-0x0000000000622000-memory.dmp

Filesize
392KB

Download
memory/3928-2-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/3928-3-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Filesize
584KB

Download
memory/3928-4-0x0000000004F90000-0x0000000004FE4000-memory.dmp

Filesize
336KB

Download
memory/3928-6-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/3928-5-0x00000000050B0000-0x000000000514C000-memory.dmp

Filesize
624KB

Download
memory/3928-7-0x0000000005000000-0x000000000500A000-memory.dmp

Filesize
40KB

Download
memory/3928-10-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4788-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4788-11-0x00000000003C0000-0x00000000003C0000-memory.dmp

Download