snakekeylogger | 2f42e126439842a833e37d5ac5a925975aeb2d9f2d39eb3579dd25d7eabf9b58

Analysis

max time kernel
14s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 00:59

Target

1ebc0bc6e88c2f8ae455a8c250a87093.exe
Size

548KB
MD5

1ebc0bc6e88c2f8ae455a8c250a87093
SHA1

cee7806eee5d4e6dbf4a04f099e8994b23118349
SHA256

2f42e126439842a833e37d5ac5a925975aeb2d9f2d39eb3579dd25d7eabf9b58
SHA512

a104f47befc39aab32e431febe5393267229def0143915f52385f913e6303582641e40e165cdecaa97334ca356567388fd1372ad036e83fc94bc48ae40416709
SSDEEP

12288:ffg2HEh0MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMW:Q2tMMMMMMMMMMMMMMMMMMMMMMMMMMMM5

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2204-7-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2204-5-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger
behavioral1/memory/2204-3-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
6 freegeoip.app
7 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

1ebc0bc6e88c2f8ae455a8c250a87093.exe

description pid process target process

PID 1740 set thread context of 2204 1740 1ebc0bc6e88c2f8ae455a8c250a87093.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

2204 MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1ebc0bc6e88c2f8ae455a8c250a87093.exe

pid process

1740 1ebc0bc6e88c2f8ae455a8c250a87093.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2204 MSBuild.exe

description	pid	process	target process
PID 1740 set thread context of 2204	1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe

pid	process
2204	MSBuild.exe

pid	process
1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe

description	pid	process
Token: SeDebugPrivilege	2204	MSBuild.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

1ebc0bc6e88c2f8ae455a8c250a87093.exe

description	pid	process	target process
PID 1740 wrote to memory of 2204	1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 1740 wrote to memory of 2204	1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 1740 wrote to memory of 2204	1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 1740 wrote to memory of 2204	1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 1740 wrote to memory of 2204	1740	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 588
2⤵
PID:2304

memory/1740-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/1740-2-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2204-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2204-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2204-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2204-8-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2204-10-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/2204-9-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2204-26-0x0000000074530000-0x0000000074ADB000-memory.dmp

Filesize
5.7MB

Download
memory/2304-25-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/2304-27-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download