snakekeylogger | beba1b53cc5aed5341b78c6011cf16136218faa25d0a5ae6b9e2e3ce952f0d78

Analysis

max time kernel
91s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

STATIONERY MATERIALS-ORDER SUPPLEMENT.exe
Size

574KB
MD5

334c0820434d474ffc6d7347f8c27697
SHA1

f0af5e6bb35f3b10f26386f4ad77db78ed0b4a72
SHA256

1aa71ccdef644e05966553af027e6434454c8e76a1e04522a7ad2da789d8f248
SHA512

8deaec055e232565d30de462082245d1d4967de1777e4d22d8969a017022da2479af029e37674c4a31d6aee1961e9b00f69808c6cf0d7a0f150a474ee2ff5d64
SSDEEP

12288:WapTqZxyRlYoeibexh9mu+02dG0cMBxo/c7mo5oFCEkv:WiTqfyRuoFbC8j0sG0J7mo5oFCEkv

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.ademkocplastik.com.tr
Port:
587
Username:
[email protected]
Password:
Ad1.iqwerty?_
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4728-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/1572-7-0x00000000025F0000-0x0000000002602000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	checkip.dyndns.org
37	freegeoip.app
38	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	4728	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4728	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93
PID 1572 wrote to memory of 4728	1572	STATIONERY MATERIALS-ORDER SUPPLEMENT.exe	93

C:\Users\Admin\AppData\Local\Temp\STATIONERY MATERIALS-ORDER SUPPLEMENT.exe
"C:\Users\Admin\AppData\Local\Temp\STATIONERY MATERIALS-ORDER SUPPLEMENT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\STATIONERY MATERIALS-ORDER SUPPLEMENT.exe
  "C:\Users\Admin\AppData\Local\Temp\STATIONERY MATERIALS-ORDER SUPPLEMENT.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1132
    3⤵
    - Program crash
    PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4728 -ip 4728
1⤵
PID:1012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\STATIONERY MATERIALS-ORDER SUPPLEMENT.exe.log

Filesize
1KB

MD5
84e77a587d94307c0ac1357eb4d3d46f

SHA1
83cc900f9401f43d181207d64c5adba7a85edc1e

SHA256
e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99

SHA512
aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691

Download Submit
memory/1572-8-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/1572-10-0x00000000069B0000-0x0000000006A22000-memory.dmp

Filesize
456KB

Download
memory/1572-3-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Filesize
584KB

Download
memory/1572-4-0x0000000004E10000-0x0000000004EAC000-memory.dmp

Filesize
624KB

Download
memory/1572-5-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/1572-6-0x0000000004D10000-0x0000000004D1A000-memory.dmp

Filesize
40KB

Download
memory/1572-7-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/1572-1-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/1572-2-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/1572-11-0x0000000006A60000-0x0000000006A8A000-memory.dmp

Filesize
168KB

Download
memory/1572-9-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download
memory/1572-15-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/1572-0-0x0000000000280000-0x0000000000316000-memory.dmp

Filesize
600KB

Download
memory/4728-16-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/4728-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4728-17-0x00000000056B0000-0x00000000056C0000-memory.dmp

Filesize
64KB

Download
memory/4728-18-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download