snakekeylogger | 8c5308faa016ec4a047a72c04fccdd6e49cece16947fc000491d947d102fdd45

Analysis

max time kernel
4s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 20:08

Target

3a439e3638fe4b48f0b76f6844c6e9a3.exe
Size

580KB
MD5

3a439e3638fe4b48f0b76f6844c6e9a3
SHA1

6c45d83f3d62cbd7af2bbf0e72aa134a6cc1509d
SHA256

8c5308faa016ec4a047a72c04fccdd6e49cece16947fc000491d947d102fdd45
SHA512

865dcafd88a016117eb6817f338058e5a6e55b3db1ebbe1e9b21f4a9c4cd9a9347e684f4458cd10490c83a76a1bedd27ffbf6c9fd2ae4b8e917afc4ec20f2051
SSDEEP

12288:3Ee9XyLSWv0NP2sg4hiBrv2Sq0WuknrhbptL3ekqjn4Or6X20:Ss1pxSkbH

Score

10^/10

Family

snakekeylogger

Credentials

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2052-9-0x0000000004C60000-0x0000000004C76000-memory.dmp	family_zgrat_v1

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1100-10-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 freegeoip.app
12 checkip.dyndns.org
26 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

description pid process target process

PID 2052 set thread context of 1100 2052 3a439e3638fe4b48f0b76f6844c6e9a3.exe 3a439e3638fe4b48f0b76f6844c6e9a3.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3164 1100 WerFault.exe 3a439e3638fe4b48f0b76f6844c6e9a3.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

pid process

1100 3a439e3638fe4b48f0b76f6844c6e9a3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

description pid process

Token: SeDebugPrivilege 1100 3a439e3638fe4b48f0b76f6844c6e9a3.exe

description	pid	process	target process
PID 2052 set thread context of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe

pid	pid_target	process	target process
3164	1100	WerFault.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe

pid	process
1100	3a439e3638fe4b48f0b76f6844c6e9a3.exe

description	pid	process
Token: SeDebugPrivilege	1100	3a439e3638fe4b48f0b76f6844c6e9a3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3a439e3638fe4b48f0b76f6844c6e9a3.exe

description	pid	process	target process
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe
PID 2052 wrote to memory of 1100	2052	3a439e3638fe4b48f0b76f6844c6e9a3.exe	3a439e3638fe4b48f0b76f6844c6e9a3.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 1760
3⤵
- Program crash
PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1100 -ip 1100
1⤵
PID:4356

memory/1100-14-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/1100-16-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/1100-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1100-15-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/2052-6-0x0000000004C30000-0x0000000004C40000-memory.dmp

Filesize
64KB

Download
memory/2052-7-0x0000000004DA0000-0x0000000004DBE000-memory.dmp

Filesize
120KB

Download
memory/2052-8-0x0000000004F20000-0x0000000004F5E000-memory.dmp

Filesize
248KB

Download
memory/2052-2-0x0000000005230000-0x00000000057D4000-memory.dmp

Filesize
5.6MB

Download
memory/2052-9-0x0000000004C60000-0x0000000004C76000-memory.dmp

Filesize
88KB

Download
memory/2052-5-0x0000000004E40000-0x0000000004EDC000-memory.dmp

Filesize
624KB

Download
memory/2052-13-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/2052-1-0x0000000074AA0000-0x0000000075250000-memory.dmp

Filesize
7.7MB

Download
memory/2052-4-0x0000000004D20000-0x0000000004D96000-memory.dmp

Filesize
472KB

Download
memory/2052-0-0x00000000001D0000-0x0000000000268000-memory.dmp

Filesize
608KB

Download
memory/2052-3-0x0000000004C80000-0x0000000004D12000-memory.dmp

Filesize
584KB

Download