snakekeylogger | c3f8b456725a6e744d7d59b5456b99c988b8b5565a18bf5f25b36a78bbed060e

Analysis

max time kernel
52s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:36

Target

Vessel Information.exe
Size

491KB
MD5

074900bf90c8e83bfd5f79479f91ed1f
SHA1

9001cb1924963b0a35db3d78d50faa3cb54bca5b
SHA256

c3f8b456725a6e744d7d59b5456b99c988b8b5565a18bf5f25b36a78bbed060e
SHA512

a9b2a8ae609174edaf49f17664514acd04dbe10f2b75af2d1a5c181e5d6cb126ecac21bc82b06721df53a99502c48e0829e737558423b89db8f0a30e87dd962b
SSDEEP

12288:ttMyF3ltmeOVahfG3+CSQ9vkk93YmSWWsGf:XM6ltmOa+CSQCk93XWsq

Score

10^/10

Family

snakekeylogger

Credentials

http://103.130.147.85

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/1504-10-0x0000000000340000-0x0000000000366000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1224 set thread context of 1504	1224	Vessel Information.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	1504	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1504	Vessel Information.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	Vessel Information.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87
PID 1224 wrote to memory of 1504	1224	Vessel Information.exe	87

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:4944

memory/1224-4-0x00000000056E0000-0x00000000056EA000-memory.dmp

Filesize
40KB

Download
memory/1224-14-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/1224-2-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Filesize
5.6MB

Download
memory/1224-3-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/1224-5-0x00000000056F0000-0x0000000005744000-memory.dmp

Filesize
336KB

Download
memory/1224-6-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/1224-8-0x0000000005770000-0x0000000005778000-memory.dmp

Filesize
32KB

Download
memory/1224-0-0x00000000750EE000-0x00000000750EF000-memory.dmp

Filesize
4KB

Download
memory/1224-1-0x0000000000A70000-0x0000000000AF2000-memory.dmp

Filesize
520KB

Download
memory/1224-7-0x0000000005820000-0x00000000058BC000-memory.dmp

Filesize
624KB

Download
memory/1504-11-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/1504-12-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download
memory/1504-10-0x0000000000340000-0x0000000000366000-memory.dmp

Filesize
152KB

Download
memory/1504-15-0x00000000750E0000-0x0000000075890000-memory.dmp

Filesize
7.7MB

Download