snakekeylogger | 3fc5704b218d36edafda4e1235bd6e254b64e80938309cdbba9b5480da410911

Analysis

max time kernel
93s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:56

Target

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe
Size

772KB
MD5

a8ef65a587aa367c3c5c9090dff4cc86
SHA1

349ac86f57b328017c9c9b478a68f610778afbeb
SHA256

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370
SHA512

356e6195db849e3cb4975579243c2f707349c6444350e09d384a3279874970bb42812d8533ed7e68d2332b22359e7dc8a9a22b2a43ba5e1ba10f69b95bedac71
SSDEEP

12288:dJpHCmbiNIwP2sBpD1tM2MH6YZLuKw3WDJV733EgpAho8WAKo9mXe:ZCFP2WpD1tM2MTZLEew

Score

10^/10

Family

snakekeylogger

http://varders.kozow.com:8081

http://aborters.duckdns.org:8081

http://anotherarmy.dns.army:8081

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2376-11-0x00000000005D0000-0x00000000005F6000-memory.dmp	family_snakekeylogger
behavioral2/memory/2376-13-0x00000000050D0000-0x00000000050E0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 checkip.dyndns.org

flow	ioc
25	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe

description	pid	process	target process
PID 1920 set thread context of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3032 2376 WerFault.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RegAsm.exe

pid process

2376 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegAsm.exe

description pid process

Token: SeDebugPrivilege 2376 RegAsm.exe

pid	pid_target	process	target process
3032	2376	WerFault.exe	RegAsm.exe

pid	process
2376	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2376	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe

description	pid	process	target process
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe
PID 1920 wrote to memory of 2376	1920	5c1784fd01fbfc4d6f8b93f3992ac9bed50cf3c98a7c7bfeef4148de01eff370.exe	RegAsm.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1556
3⤵
- Program crash
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2376 -ip 2376
1⤵
PID:2112

memory/1920-6-0x0000000005960000-0x00000000059FC000-memory.dmp

Filesize
624KB

Download
memory/1920-0-0x0000000000C80000-0x0000000000D46000-memory.dmp

Filesize
792KB

Download
memory/1920-2-0x00000000056E0000-0x00000000056F0000-memory.dmp

Filesize
64KB

Download
memory/1920-3-0x00000000056F0000-0x0000000005744000-memory.dmp

Filesize
336KB

Download
memory/1920-4-0x0000000005CF0000-0x0000000006294000-memory.dmp

Filesize
5.6MB

Download
memory/1920-5-0x0000000005820000-0x00000000058B2000-memory.dmp

Filesize
584KB

Download
memory/1920-1-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/1920-7-0x00000000057D0000-0x00000000057D8000-memory.dmp

Filesize
32KB

Download
memory/1920-10-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2376-12-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/2376-8-0x0000000000410000-0x0000000000430000-memory.dmp

Filesize
128KB

Download
memory/2376-11-0x00000000005D0000-0x00000000005F6000-memory.dmp

Filesize
152KB

Download
memory/2376-13-0x00000000050D0000-0x00000000050E0000-memory.dmp

Filesize
64KB

Download
memory/2376-14-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download