snakekeylogger | 67051497fd97c6af464c672d930bc0e03f49fec42759bd94e1d5b7c3cf34e7bb

Analysis

max time kernel
43s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2023 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe
Size

772KB
MD5

0390281aa6bea2fccb424eec15cc7e78
SHA1

cbbe6381a0292f69bab951edd849fb713d4f76b2
SHA256

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651
SHA512

7f23783f6b54551ae0779012031b9d595b14dffc80a11274c43011606d80c86063513d00e1503853e4353e2249c36a886c6f12cbbfe032e334d152d979a2bc24
SSDEEP

12288:dJpHCmbiNIwPt2gBpD1tM2MH6YZLuKw3WDJV733EgpAUBXvlL/bD9x7DW:ZCFPtBpD1tM2MTZLE6/l

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3292-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

47 checkip.dyndns.org

flow	ioc
47	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe

description	pid	process	target process
PID 3096 set thread context of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

3292 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 3292 RegAsm.exe

pid	process
3292	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3292	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe

description	pid	process	target process
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe
PID 3096 wrote to memory of 3292	3096	ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe
"C:\Users\Admin\AppData\Local\Temp\ff6906393f892736432d9766c5d503855ea909e8165244e641aa986d61737651.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3096-10-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3096-5-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/3096-0-0x00000000005E0000-0x00000000006A6000-memory.dmp

Filesize
792KB

Download
memory/3096-4-0x00000000056B0000-0x0000000005C54000-memory.dmp

Filesize
5.6MB

Download
memory/3096-7-0x0000000005130000-0x0000000005138000-memory.dmp

Filesize
32KB

Download
memory/3096-2-0x00000000050F0000-0x0000000005100000-memory.dmp

Filesize
64KB

Download
memory/3096-6-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/3096-1-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3096-3-0x0000000005010000-0x0000000005064000-memory.dmp

Filesize
336KB

Download
memory/3292-12-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/3292-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3292-11-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3292-13-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3292-14-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/3292-15-0x0000000006310000-0x0000000006360000-memory.dmp

Filesize
320KB

Download
memory/3292-16-0x0000000006530000-0x00000000066F2000-memory.dmp

Filesize
1.8MB

Download
memory/3292-17-0x0000000006390000-0x000000000639A000-memory.dmp

Filesize
40KB

Download