Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2024, 22:19

General

  • Target

    82b51cd131dfd15563e352b5ee83163c.exe

  • Size

    1.1MB

  • MD5

    82b51cd131dfd15563e352b5ee83163c

  • SHA1

    72b3d1a8808cab246e32fe657e840189d3ca7380

  • SHA256

    31b5000cf78635731bfe23c558dfe5b7f5319ee14fc34864a51e6cc125647a41

  • SHA512

    e0140f34ba56ec152f1cc6add6f834861ba6d38bcf08cbd6a03d8c27b1e0bd11701949c2925f173d3b8691db86a3160991823e34539e8d3a49a03f865b2dce2b

  • SSDEEP

    24576:07ATQeuFFYTblhBUunsif1932vJafiiKhxxs:Qyf1Ur073BfiiKZs

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 6 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe
    "C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe
      "C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe"
      2⤵
        PID:2532
      • C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe
        "C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe"
        2⤵
          PID:2528
        • C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe
          "C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2548
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 1616
            3⤵
            • Program crash
            PID:908

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/2416-0-0x0000000000230000-0x000000000034E000-memory.dmp

              Filesize

              1.1MB

            • memory/2416-1-0x0000000074430000-0x0000000074B1E000-memory.dmp

              Filesize

              6.9MB

            • memory/2416-2-0x0000000004E60000-0x0000000004EA0000-memory.dmp

              Filesize

              256KB

            • memory/2416-3-0x0000000000570000-0x0000000000588000-memory.dmp

              Filesize

              96KB

            • memory/2416-4-0x0000000074430000-0x0000000074B1E000-memory.dmp

              Filesize

              6.9MB

            • memory/2416-5-0x0000000004E60000-0x0000000004EA0000-memory.dmp

              Filesize

              256KB

            • memory/2416-6-0x0000000005FA0000-0x0000000006030000-memory.dmp

              Filesize

              576KB

            • memory/2416-7-0x0000000000710000-0x0000000000734000-memory.dmp

              Filesize

              144KB

            • memory/2416-18-0x0000000074430000-0x0000000074B1E000-memory.dmp

              Filesize

              6.9MB

            • memory/2548-10-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-9-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-11-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/2548-14-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-8-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-16-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-19-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2548-20-0x0000000073450000-0x0000000073B3E000-memory.dmp

              Filesize

              6.9MB

            • memory/2548-21-0x0000000004BC0000-0x0000000004C00000-memory.dmp

              Filesize

              256KB

            • memory/2548-22-0x0000000073450000-0x0000000073B3E000-memory.dmp

              Filesize

              6.9MB

            • memory/2548-23-0x0000000004BC0000-0x0000000004C00000-memory.dmp

              Filesize

              256KB