Analysis

  • max time kernel
    121s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 14:08

General

  • Target

    d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe

  • Size

    464KB

  • MD5

    1f7ac06f56077381b5097cde5c4cab87

  • SHA1

    5738220c5460de988a1b30a3a9532fd226d9d3b8

  • SHA256

    d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb

  • SHA512

    2426d1466ec06f3e67e3fdf7f01eb79cc11e46711e955e73a28d43dc5452881bfbd62d189c082d6b6224b58ab9f51a723d58688883c61ee7703cfcfeed0f2f3f

  • SSDEEP

    12288:vCXFQTAajA6n1tiGSZ4EidlIw8mfcMAAAAAAAAAAMA5AAAAAAAAAAAAAAAAAAAAP:vqFQTAajA4fo4EiIw8ccMAAAAAAAAAAd

Malware Config

Extracted

Family

snakekeylogger

Credentials
C2

https://scratchdreams.tk

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • Snake Keylogger payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
    "C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe
      "C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Windows\SysWOW64\choice.exe
          choice /C Y /N /D Y /T 3
          4⤵
            PID:1664

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d3731523378b28ee05796acb58b58f60f9f6021e239189acb06907abe5d008cb.exe.log

      Filesize

      706B

      MD5

      f8bcaf312de8591707436c1dcebba8e4

      SHA1

      a1269828e5f644601622f4a7a611aec8f2eda0b2

      SHA256

      f0f5a90777c70cdceea22bd66b33c1703a318acc45cb012d0b01585a1ac12b29

      SHA512

      3a714f5950584abbc94a27bbd4623bfc5acb1135c8c9fca4d74e70c8481b71ace7dbc1dfbf101dd07c76a050acfb4852f31dd57fc7ae196382336c5edc9e6413

    • memory/3444-3-0x0000000005860000-0x00000000058B6000-memory.dmp

      Filesize

      344KB

    • memory/3444-2-0x00000000058C0000-0x00000000058D0000-memory.dmp

      Filesize

      64KB

    • memory/3444-0-0x0000000000EC0000-0x0000000000F3A000-memory.dmp

      Filesize

      488KB

    • memory/3444-4-0x0000000005EF0000-0x0000000006494000-memory.dmp

      Filesize

      5.6MB

    • memory/3444-5-0x00000000059F0000-0x0000000005A82000-memory.dmp

      Filesize

      584KB

    • memory/3444-6-0x0000000005B30000-0x0000000005BCC000-memory.dmp

      Filesize

      624KB

    • memory/3444-7-0x00000000059C0000-0x00000000059C8000-memory.dmp

      Filesize

      32KB

    • memory/3444-1-0x0000000075090000-0x0000000075840000-memory.dmp

      Filesize

      7.7MB

    • memory/3444-12-0x0000000075090000-0x0000000075840000-memory.dmp

      Filesize

      7.7MB

    • memory/3484-8-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

    • memory/3484-11-0x0000000075090000-0x0000000075840000-memory.dmp

      Filesize

      7.7MB

    • memory/3484-13-0x0000000005850000-0x0000000005860000-memory.dmp

      Filesize

      64KB

    • memory/3484-14-0x0000000075090000-0x0000000075840000-memory.dmp

      Filesize

      7.7MB