Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe
Resource
win10v2004-20231215-en
General
-
Target
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe
-
Size
1.2MB
-
MD5
aaea6cf42726217d2ad73028dd781478
-
SHA1
7da9bf7a71246dffc089f8186c5a0912e0a70fd8
-
SHA256
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8
-
SHA512
d4f7d2d5f2554e6b9caae87002eaaf6d33a58609bed21468699f8f8317f508d1668269c05acb8f805ce7b1f967a66ca430206c8ca1f39e5adaa016a7191fdc56
-
SSDEEP
12288:PnaPjK9IBlnj0T94KxKNBNkCVr5B8TdtGUy+dXUixJCbBghM/Oy+4Oi+4hfKRzrt:PnaPDZYT9sS61ijy7KNrkntJ3cNkW
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 6 IoCs
resource yara_rule behavioral1/memory/2688-9-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2688-11-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2688-16-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2688-18-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2688-22-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger behavioral1/memory/2688-25-0x0000000000090000-0x00000000000B6000-memory.dmp family_snakekeylogger -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2796 set thread context of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2688 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2688 RegAsm.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2796 wrote to memory of 2688 2796 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 28 PID 2688 wrote to memory of 1696 2688 RegAsm.exe 31 PID 2688 wrote to memory of 1696 2688 RegAsm.exe 31 PID 2688 wrote to memory of 1696 2688 RegAsm.exe 31 PID 2688 wrote to memory of 1696 2688 RegAsm.exe 31 PID 1696 wrote to memory of 1776 1696 cmd.exe 33 PID 1696 wrote to memory of 1776 1696 cmd.exe 33 PID 1696 wrote to memory of 1776 1696 cmd.exe 33 PID 1696 wrote to memory of 1776 1696 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe"C:\Users\Admin\AppData\Local\Temp\80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:1776
-
-
-