Analysis

  • max time kernel
    135s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2024, 22:19

General

  • Target

    82b51cd131dfd15563e352b5ee83163c.exe

  • Size

    1.1MB

  • MD5

    82b51cd131dfd15563e352b5ee83163c

  • SHA1

    72b3d1a8808cab246e32fe657e840189d3ca7380

  • SHA256

    31b5000cf78635731bfe23c558dfe5b7f5319ee14fc34864a51e6cc125647a41

  • SHA512

    e0140f34ba56ec152f1cc6add6f834861ba6d38bcf08cbd6a03d8c27b1e0bd11701949c2925f173d3b8691db86a3160991823e34539e8d3a49a03f865b2dce2b

  • SSDEEP

    24576:07ATQeuFFYTblhBUunsif1932vJafiiKhxxs:Qyf1Ur073BfiiKZs

Malware Config

Extracted

Family

snakekeylogger

Credentials

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe
    "C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe
      "C:\Users\Admin\AppData\Local\Temp\82b51cd131dfd15563e352b5ee83163c.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 1828
        3⤵
        • Program crash
        PID:4436
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2252 -ip 2252
    1⤵
      PID:712

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2252-13-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2252-18-0x00000000746C0000-0x0000000074E70000-memory.dmp

            Filesize

            7.7MB

          • memory/2252-17-0x00000000056E0000-0x00000000056F0000-memory.dmp

            Filesize

            64KB

          • memory/2252-14-0x00000000746C0000-0x0000000074E70000-memory.dmp

            Filesize

            7.7MB

          • memory/4516-8-0x0000000005540000-0x0000000005558000-memory.dmp

            Filesize

            96KB

          • memory/4516-11-0x00000000082B0000-0x0000000008340000-memory.dmp

            Filesize

            576KB

          • memory/4516-6-0x0000000005020000-0x000000000502A000-memory.dmp

            Filesize

            40KB

          • memory/4516-7-0x00000000052C0000-0x0000000005316000-memory.dmp

            Filesize

            344KB

          • memory/4516-0-0x00000000746C0000-0x0000000074E70000-memory.dmp

            Filesize

            7.7MB

          • memory/4516-9-0x00000000746C0000-0x0000000074E70000-memory.dmp

            Filesize

            7.7MB

          • memory/4516-10-0x0000000004F90000-0x0000000004FA0000-memory.dmp

            Filesize

            64KB

          • memory/4516-5-0x0000000004F90000-0x0000000004FA0000-memory.dmp

            Filesize

            64KB

          • memory/4516-12-0x000000000AA40000-0x000000000AA64000-memory.dmp

            Filesize

            144KB

          • memory/4516-4-0x00000000050D0000-0x0000000005162000-memory.dmp

            Filesize

            584KB

          • memory/4516-3-0x0000000005680000-0x0000000005C24000-memory.dmp

            Filesize

            5.6MB

          • memory/4516-16-0x00000000746C0000-0x0000000074E70000-memory.dmp

            Filesize

            7.7MB

          • memory/4516-2-0x0000000005030000-0x00000000050CC000-memory.dmp

            Filesize

            624KB

          • memory/4516-1-0x0000000000500000-0x000000000061E000-memory.dmp

            Filesize

            1.1MB