snakekeylogger | 2f42e126439842a833e37d5ac5a925975aeb2d9f2d39eb3579dd25d7eabf9b58

Analysis

max time kernel
5s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 00:59

Target

1ebc0bc6e88c2f8ae455a8c250a87093.exe
Size

548KB
MD5

1ebc0bc6e88c2f8ae455a8c250a87093
SHA1

cee7806eee5d4e6dbf4a04f099e8994b23118349
SHA256

2f42e126439842a833e37d5ac5a925975aeb2d9f2d39eb3579dd25d7eabf9b58
SHA512

a104f47befc39aab32e431febe5393267229def0143915f52385f913e6303582641e40e165cdecaa97334ca356567388fd1372ad036e83fc94bc48ae40416709
SSDEEP

12288:ffg2HEh0MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMMMMMMMMMMMMMMMMMMW:Q2tMMMMMMMMMMMMMMMMMMMMMMMMMMMM5

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3468-3-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 checkip.dyndns.org
17 freegeoip.app
18 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

1ebc0bc6e88c2f8ae455a8c250a87093.exe

description pid process target process

PID 3864 set thread context of 3468 3864 1ebc0bc6e88c2f8ae455a8c250a87093.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

3468 MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1ebc0bc6e88c2f8ae455a8c250a87093.exe

pid process

3864 1ebc0bc6e88c2f8ae455a8c250a87093.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

MSBuild.exedw20.exe

description pid process

Token: SeDebugPrivilege 3468 MSBuild.exe
Token: SeRestorePrivilege 4056 dw20.exe
Token: SeBackupPrivilege 4056 dw20.exe

description	pid	process	target process
PID 3864 set thread context of 3468	3864	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe

pid	process
3468	MSBuild.exe

pid	process
3864	1ebc0bc6e88c2f8ae455a8c250a87093.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

1ebc0bc6e88c2f8ae455a8c250a87093.exeMSBuild.exe

description	pid	process	target process
PID 3864 wrote to memory of 3468	3864	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 3864 wrote to memory of 3468	3864	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 3864 wrote to memory of 3468	3864	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 3864 wrote to memory of 3468	3864	1ebc0bc6e88c2f8ae455a8c250a87093.exe	MSBuild.exe
PID 3468 wrote to memory of 4056	3468	MSBuild.exe	dw20.exe
PID 3468 wrote to memory of 4056	3468	MSBuild.exe	dw20.exe
PID 3468 wrote to memory of 4056	3468	MSBuild.exe	dw20.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1696
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4056

memory/3468-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3468-4-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/3468-6-0x00000000013D0000-0x00000000013E0000-memory.dmp

Filesize
64KB

Download
memory/3468-5-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/3468-13-0x00000000752E0000-0x0000000075891000-memory.dmp

Filesize
5.7MB

Download
memory/3864-2-0x0000000000C10000-0x0000000000C12000-memory.dmp

Filesize
8KB

Download
memory/3864-1-0x0000000000600000-0x0000000000700000-memory.dmp

Filesize
1024KB

Download