Analysis
-
max time kernel
92s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe
Resource
win10v2004-20231215-en
General
-
Target
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe
-
Size
1.2MB
-
MD5
aaea6cf42726217d2ad73028dd781478
-
SHA1
7da9bf7a71246dffc089f8186c5a0912e0a70fd8
-
SHA256
80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8
-
SHA512
d4f7d2d5f2554e6b9caae87002eaaf6d33a58609bed21468699f8f8317f508d1668269c05acb8f805ce7b1f967a66ca430206c8ca1f39e5adaa016a7191fdc56
-
SSDEEP
12288:PnaPjK9IBlnj0T94KxKNBNkCVr5B8TdtGUy+dXUixJCbBghM/Oy+4Oi+4hfKRzrt:PnaPDZYT9sS61ijy7KNrkntJ3cNkW
Malware Config
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/4948-8-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4612 set thread context of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4948 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4948 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4612 wrote to memory of 4948 4612 80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe 91 PID 4948 wrote to memory of 3700 4948 RegAsm.exe 92 PID 4948 wrote to memory of 3700 4948 RegAsm.exe 92 PID 4948 wrote to memory of 3700 4948 RegAsm.exe 92 PID 3700 wrote to memory of 2536 3700 cmd.exe 94 PID 3700 wrote to memory of 2536 3700 cmd.exe 94 PID 3700 wrote to memory of 2536 3700 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe"C:\Users\Admin\AppData\Local\Temp\80e12c2425ec7b8aa8913df82bd47c0c1a62f6539df22b6bf1ddab8b1694e3e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 34⤵PID:2536
-
-
-