snakekeylogger | e135385603e2df5429b326841d4755f9edc6bcd86450f04d284dc45ea621c56c

Analysis

max time kernel
142s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 03:02

Target

4ea950fc894a846d1a68931b149c2802.exe
Size

342KB
MD5

4ea950fc894a846d1a68931b149c2802
SHA1

88f7997ad608ecda14e0af5594d89d418ec38808
SHA256

e135385603e2df5429b326841d4755f9edc6bcd86450f04d284dc45ea621c56c
SHA512

950c7a7d85f2af7b48909934454e8b8ff5f05f3c5543261fc70f0361c37c5d48af973c0e1eacc1e466ab1ced12b4a61bfbc690870895715d0c89bb8ff1b49b1b
SSDEEP

6144:CZGh9F7ZmKBcgqh3SBuvXUW64ROVlYpvvnEHrCZyp/zpXW5mq6ExGNElnzGWwXFf:CZG1dmKO0SE+OnY5sHrCZ2zZW4qrxPlC

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3428-3-0x0000000000700000-0x0000000000726000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 checkip.dyndns.org
32 freegeoip.app
34 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

4ea950fc894a846d1a68931b149c2802.exe

description pid process target process

PID 1288 set thread context of 3428 1288 4ea950fc894a846d1a68931b149c2802.exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5016 3428 WerFault.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

3428 MSBuild.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

4ea950fc894a846d1a68931b149c2802.exe

pid process

1288 4ea950fc894a846d1a68931b149c2802.exe
1288 4ea950fc894a846d1a68931b149c2802.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 3428 MSBuild.exe

description	pid	process	target process
PID 1288 set thread context of 3428	1288	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe

pid	pid_target	process	target process
5016	3428	WerFault.exe	MSBuild.exe

pid	process
3428	MSBuild.exe

pid	process
1288	4ea950fc894a846d1a68931b149c2802.exe
1288	4ea950fc894a846d1a68931b149c2802.exe

description	pid	process
Token: SeDebugPrivilege	3428	MSBuild.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4ea950fc894a846d1a68931b149c2802.exe

description	pid	process	target process
PID 1288 wrote to memory of 3428	1288	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1288 wrote to memory of 3428	1288	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1288 wrote to memory of 3428	1288	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe
PID 1288 wrote to memory of 3428	1288	4ea950fc894a846d1a68931b149c2802.exe	MSBuild.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 1780
3⤵
- Program crash
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3428 -ip 3428
1⤵
PID:1920

memory/1288-2-0x0000000003780000-0x0000000003782000-memory.dmp

Filesize
8KB

Download
memory/1288-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/3428-3-0x0000000000700000-0x0000000000726000-memory.dmp

Filesize
152KB

Download
memory/3428-4-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/3428-5-0x0000000005220000-0x00000000057C4000-memory.dmp

Filesize
5.6MB

Download
memory/3428-6-0x0000000004C70000-0x0000000004D0C000-memory.dmp

Filesize
624KB

Download
memory/3428-7-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3428-8-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download
memory/3428-9-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

Filesize
64KB

Download
memory/3428-10-0x0000000075310000-0x0000000075AC0000-memory.dmp

Filesize
7.7MB

Download