Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 19:55

General

  • Target

    3988c73d0fe8cc854333752bc9c16413.exe

  • Size

    547KB

  • MD5

    3988c73d0fe8cc854333752bc9c16413

  • SHA1

    607cf59d672fc032bcd63caa0e77b0c3a62121b9

  • SHA256

    78c0352da41b3c206b12ea2d8d3f96c33c361e2211437c9746629023b1f0c094

  • SHA512

    1ac7d447c0ce756af2bfc381dc1c8d939e0e649d76ead8da7d9abd24dee3758192a6bd0cd9bcef5e72f2df507a18a8f1bde3b89867eb17895fb0f18b0faf0744

  • SSDEEP

    12288:iDjhrIh5IkB3OH3tguqnqd6KcuM4ry5ehNhjKUSotTkFW/Y74U:iDjhr0IJ9gydpcB4Q

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3988c73d0fe8cc854333752bc9c16413.exe
    "C:\Users\Admin\AppData\Local\Temp\3988c73d0fe8cc854333752bc9c16413.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\AppData\Local\Temp\3988c73d0fe8cc854333752bc9c16413.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1812
        3⤵
        • Program crash
        PID:1220
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2432 -ip 2432
    1⤵
      PID:760

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3988c73d0fe8cc854333752bc9c16413.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • memory/2432-12-0x0000000000400000-0x0000000000424000-memory.dmp

      Filesize

      144KB

    • memory/2432-20-0x0000000074F50000-0x0000000075700000-memory.dmp

      Filesize

      7.7MB

    • memory/2432-19-0x0000000005780000-0x0000000005790000-memory.dmp

      Filesize

      64KB

    • memory/2432-18-0x0000000074F50000-0x0000000075700000-memory.dmp

      Filesize

      7.7MB

    • memory/2432-17-0x0000000005780000-0x0000000005790000-memory.dmp

      Filesize

      64KB

    • memory/2432-16-0x0000000074F50000-0x0000000075700000-memory.dmp

      Filesize

      7.7MB

    • memory/5044-5-0x0000000005210000-0x000000000521A000-memory.dmp

      Filesize

      40KB

    • memory/5044-8-0x0000000074F50000-0x0000000075700000-memory.dmp

      Filesize

      7.7MB

    • memory/5044-9-0x00000000054B0000-0x00000000054C0000-memory.dmp

      Filesize

      64KB

    • memory/5044-10-0x0000000007D40000-0x0000000007DB4000-memory.dmp

      Filesize

      464KB

    • memory/5044-11-0x000000000A450000-0x000000000A47A000-memory.dmp

      Filesize

      168KB

    • memory/5044-7-0x0000000006480000-0x000000000651C000-memory.dmp

      Filesize

      624KB

    • memory/5044-6-0x00000000054A0000-0x00000000054A8000-memory.dmp

      Filesize

      32KB

    • memory/5044-15-0x0000000074F50000-0x0000000075700000-memory.dmp

      Filesize

      7.7MB

    • memory/5044-0-0x0000000074F50000-0x0000000075700000-memory.dmp

      Filesize

      7.7MB

    • memory/5044-4-0x00000000054B0000-0x00000000054C0000-memory.dmp

      Filesize

      64KB

    • memory/5044-3-0x0000000005280000-0x0000000005312000-memory.dmp

      Filesize

      584KB

    • memory/5044-2-0x0000000005830000-0x0000000005DD4000-memory.dmp

      Filesize

      5.6MB

    • memory/5044-1-0x00000000007A0000-0x0000000000830000-memory.dmp

      Filesize

      576KB