snakekeylogger | 7d5f45e05a65fbbcc78417cebda88591bc626b5a61643995d496c2a318270760

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Project 4302021KSA.exe
Size

1.3MB
MD5

75dd111b19ce0b8dfaecccf2e12f44f9
SHA1

c16c31f8f80ea50065e39808bcdf7f4e8535497a
SHA256

55bd833636eeb445bd7e1ef5d23b5ce1a5bc26a3e6de305f37b8e285cec68443
SHA512

55b190fad095d1dd07d6f9104c15a2a9f36a0e1877ab68205f8adc781fc4fa2344a60774f55c5fa306eaa4a7d41f8d710b4e559ad40d8c225d10dfe76a3fc316
SSDEEP

24576:KoLemDiufx8DgMfx8Dgf49gsTfB5fihpQEGqscZCHLL:KoL9DT58DgM58DgfKg0PqQmZCr

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1228-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

49 checkip.dyndns.org
51 freegeoip.app
52 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

Project 4302021KSA.exe

description pid process target process

PID 2156 set thread context of 1228 2156 Project 4302021KSA.exe Project 4302021KSA.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3988 1228 WerFault.exe Project 4302021KSA.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Project 4302021KSA.exe

pid process

1228 Project 4302021KSA.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Project 4302021KSA.exe

description pid process

Token: SeDebugPrivilege 1228 Project 4302021KSA.exe

flow	ioc
49	checkip.dyndns.org
51	freegeoip.app
52	freegeoip.app

description	pid	process	target process
PID 2156 set thread context of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe

pid	pid_target	process	target process
3988	1228	WerFault.exe	Project 4302021KSA.exe

pid	process
1228	Project 4302021KSA.exe

description	pid	process
Token: SeDebugPrivilege	1228	Project 4302021KSA.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Project 4302021KSA.exe

description	pid	process	target process
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe
PID 2156 wrote to memory of 1228	2156	Project 4302021KSA.exe	Project 4302021KSA.exe

C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe
"C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe
"C:\Users\Admin\AppData\Local\Temp\Project 4302021KSA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1772
3⤵
- Program crash
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1228 -ip 1228
1⤵
PID:4768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Project 4302021KSA.exe.log
Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1228-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1228-18-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/1228-17-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/1228-16-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2156-4-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/2156-6-0x0000000005580000-0x000000000561C000-memory.dmp

Filesize
624KB

Download
memory/2156-7-0x0000000004C30000-0x0000000004C42000-memory.dmp

Filesize
72KB

Download
memory/2156-8-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2156-9-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/2156-10-0x0000000009230000-0x00000000092BC000-memory.dmp

Filesize
560KB

Download
memory/2156-11-0x0000000006ED0000-0x0000000006EF4000-memory.dmp

Filesize
144KB

Download
memory/2156-5-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/2156-1-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2156-15-0x0000000074E20000-0x00000000755D0000-memory.dmp

Filesize
7.7MB

Download
memory/2156-3-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/2156-2-0x0000000005720000-0x0000000005CC4000-memory.dmp

Filesize
5.6MB

Download
memory/2156-0-0x00000000006A0000-0x00000000007F6000-memory.dmp

Filesize
1.3MB

Download