snakekeylogger | 5abec5e92048d2cf64785ed4a873acc4fd88be7d361e47b5508753bd43eeafb2

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d472944cce2a1a6664c29336004f22c.exe
Size

998KB
MD5

2d472944cce2a1a6664c29336004f22c
SHA1

2d88407509c184f6ea85f81910f4c81dc118499b
SHA256

5abec5e92048d2cf64785ed4a873acc4fd88be7d361e47b5508753bd43eeafb2
SHA512

b4d24ccd5a345fbcd845b7cb4176bb23e5bc42a8e1e4302ba7d2a4c67864ff7e266351e3910ba32eb4799159e3c35d7465cb4fa6fe4324255b82bed377f21cf1
SSDEEP

24576:JoFGjUhRm/dFgaK64E3MyOvAcamEe/aNF0ZoR:CFk69aK6443OYO0Noc

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
25
Username:
[email protected]
Password:
BkKMmzZ1
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4704-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/3692-8-0x0000000005670000-0x0000000005682000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

63 freegeoip.app
60 checkip.dyndns.org
62 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

description pid process target process

PID 3692 set thread context of 4704 3692 2d472944cce2a1a6664c29336004f22c.exe 2d472944cce2a1a6664c29336004f22c.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5084 4704 WerFault.exe 2d472944cce2a1a6664c29336004f22c.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

pid process

4704 2d472944cce2a1a6664c29336004f22c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

description pid process

Token: SeDebugPrivilege 4704 2d472944cce2a1a6664c29336004f22c.exe

flow	ioc
63	freegeoip.app
60	checkip.dyndns.org
62	freegeoip.app

description	pid	process	target process
PID 3692 set thread context of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe

pid	pid_target	process	target process
5084	4704	WerFault.exe	2d472944cce2a1a6664c29336004f22c.exe

pid	process
4704	2d472944cce2a1a6664c29336004f22c.exe

description	pid	process
Token: SeDebugPrivilege	4704	2d472944cce2a1a6664c29336004f22c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2d472944cce2a1a6664c29336004f22c.exe

description	pid	process	target process
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe
PID 3692 wrote to memory of 4704	3692	2d472944cce2a1a6664c29336004f22c.exe	2d472944cce2a1a6664c29336004f22c.exe

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3692

C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe
"C:\Users\Admin\AppData\Local\Temp\2d472944cce2a1a6664c29336004f22c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1804
3⤵
- Program crash
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4704 -ip 4704
1⤵
PID:4352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3692-8-0x0000000005670000-0x0000000005682000-memory.dmp

Filesize
72KB

Download
memory/3692-1-0x0000000000850000-0x0000000000950000-memory.dmp

Filesize
1024KB

Download
memory/3692-9-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/3692-10-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/3692-3-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/3692-5-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/3692-7-0x0000000005690000-0x00000000056E6000-memory.dmp

Filesize
344KB

Download
memory/3692-6-0x00000000053E0000-0x00000000053EA000-memory.dmp

Filesize
40KB

Download
memory/3692-0-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/3692-2-0x0000000005320000-0x00000000053BC000-memory.dmp

Filesize
624KB

Download
memory/3692-4-0x0000000005460000-0x00000000054F2000-memory.dmp

Filesize
584KB

Download
memory/3692-11-0x0000000006C30000-0x0000000006C98000-memory.dmp

Filesize
416KB

Download
memory/3692-12-0x0000000006CC0000-0x0000000006CE6000-memory.dmp

Filesize
152KB

Download
memory/3692-16-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/4704-17-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download
memory/4704-18-0x0000000005050000-0x0000000005060000-memory.dmp

Filesize
64KB

Download
memory/4704-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4704-19-0x0000000074DA0000-0x0000000075550000-memory.dmp

Filesize
7.7MB

Download