snakekeylogger | dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70

Analysis

max time kernel
173s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Voyage Orders.exe
Size 1.1MB
Sample240108-vekl2aefe6
SHA256 dd2bb6ea65c082f25a75158f22c2d10e3be1daa026334a8d8e06007bbd245f70
MD5 3f400d97f2abae8a447d88bbb47824f1
SHA1 1b33aa3560dea16c37f08a3c0dd3923f5132c921
SHA512 12e530e7c6ecbbb865e81df9e077b29dcdae2503d99b4933c5570b435af1e44545a6a673103d12be13a95014662f1a6192bc673e1a1876abca555baef8db88e0
SSDEEP 12288:kdvgY7jTcqzDa8Zxu+Qor+gwbsFtswi5YBGqqpw35ZM2Jg7CTzvV2ucA:kdvgQtzDa8HZr1wm5Z9LTzvVeA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4548-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 4548	5012	Voyage Orders.exe	107

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4548	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107
PID 5012 wrote to memory of 4548	5012	Voyage Orders.exe	107

C:\Users\Admin\AppData\Local\Temp\Voyage Orders.exe
"C:\Users\Admin\AppData\Local\Temp\Voyage Orders.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4548-10-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4548-13-0x0000000074AC0000-0x0000000075270000-memory.dmp

Download

memory/5012-6-0x0000000005790000-0x0000000005822000-memory.dmp

Download

memory/5012-3-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/5012-4-0x0000000005680000-0x00000000056D4000-memory.dmp

Download

memory/5012-5-0x0000000005C80000-0x0000000006224000-memory.dmp

Download

memory/5012-0-0x0000000074AC0000-0x0000000075270000-memory.dmp

Download

memory/5012-7-0x0000000005570000-0x0000000005580000-memory.dmp

Download

memory/5012-8-0x00000000058D0000-0x000000000596C000-memory.dmp

Download

memory/5012-9-0x0000000005760000-0x0000000005768000-memory.dmp

Download

memory/5012-2-0x0000000074AC0000-0x0000000075270000-memory.dmp

Download

memory/5012-12-0x0000000074AC0000-0x0000000075270000-memory.dmp

Download

memory/5012-1-0x0000000000A70000-0x0000000000B90000-memory.dmp

Download