snakekeylogger | d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaa

Analysis

max time kernel
75s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 18:09

Target

d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe
Size

518KB
MD5

66b0530dc094491748a9632d53d51623
SHA1

23686beaefd8470f8d904522778f4c67ba641d09
SHA256

d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaa
SHA512

c355d74a045e77da315270f352f6b130af5280058044a8fb3804d262ac6e75d4de8f7a2274fea9441ef2cb8b1c044dc7fb979a1f9a8a08cd04a90963271be012
SSDEEP

12288:Gv45+po2ZEWI1InUKJjMUiC1zrN92LI2tneyLw24/wcT7ibH/zV+g/U:Gu+pJZbI1MNni+rv+I20yZIDT7QHrIgM

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4028-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 checkip.dyndns.org

flow	ioc
8	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe

description	pid	process	target process
PID 3736 set thread context of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2228 4028 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegSvcs.exe

pid process

4028 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4028 RegSvcs.exe

pid	pid_target	process	target process
2228	4028	WerFault.exe	RegSvcs.exe

pid	process
4028	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4028	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe

description	pid	process	target process
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe
PID 3736 wrote to memory of 4028	3736	d181fed18a646621f4f6441afbce6f32afbe5fb13cd3923b9c4d03a485b30eaaexe.exe	RegSvcs.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 1420
3⤵
- Program crash
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4028 -ip 4028
1⤵
PID:3508

memory/3736-8-0x00000000058B0000-0x00000000058BA000-memory.dmp

Filesize
40KB

Download
memory/3736-6-0x0000000005750000-0x0000000005768000-memory.dmp

Filesize
96KB

Download
memory/3736-2-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/3736-3-0x0000000005B00000-0x00000000060A4000-memory.dmp

Filesize
5.6MB

Download
memory/3736-1-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/3736-5-0x0000000005740000-0x000000000574A000-memory.dmp

Filesize
40KB

Download
memory/3736-0-0x0000000000A10000-0x0000000000A98000-memory.dmp

Filesize
544KB

Download
memory/3736-7-0x00000000058A0000-0x00000000058A8000-memory.dmp

Filesize
32KB

Download
memory/3736-4-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/3736-9-0x00000000080E0000-0x0000000008140000-memory.dmp

Filesize
384KB

Download
memory/3736-10-0x0000000007F40000-0x0000000007FDC000-memory.dmp

Filesize
624KB

Download
memory/3736-14-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4028-13-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download
memory/4028-15-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/4028-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4028-16-0x0000000074EE0000-0x0000000075690000-memory.dmp

Filesize
7.7MB

Download