snakekeylogger | 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
motech24062024.pdf.exe
Size 535KB
Sample240624-nbzhfssfpp
SHA256 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3
MD5 902b1157277ecbe3917b85fa905e7f4d
SHA1 6dbb38742564c4f64718e60e5efed146b30b0c83
SHA512 71ef622ca4c59a1ec548cd21f09c40d4c6356a75158dbe54008596988d8bc6ee15926012d2cb97a57f5dbad22f3dadbf5d6f234199e3240edb3814d6fa7f746b
SSDEEP 6144:fx3JWzvWtGwhhvISKQjDNSfZilVj4G5MNklWJ8u//z8K8ICFw7JwHOevcKX3frqg:f3mmhAv4qAlMSMRF8s7yHJv/v+2LuSn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.mastersharks.com
Port
587
Username
[email protected]
Password
=)!5e%+IUZ$q0bJM
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

resource	yara_rule
behavioral1/memory/2124-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2124-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2124-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2124-8-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2124-7-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 2124	1028	motech24062024.pdf.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2200	2124	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2124	motech24062024.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	motech24062024.pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 1028 wrote to memory of 2124	1028	motech24062024.pdf.exe	28
PID 2124 wrote to memory of 2200	2124	motech24062024.pdf.exe	29
PID 2124 wrote to memory of 2200	2124	motech24062024.pdf.exe	29
PID 2124 wrote to memory of 2200	2124	motech24062024.pdf.exe	29
PID 2124 wrote to memory of 2200	2124	motech24062024.pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 556
    3⤵
    - Program crash
    PID:2200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

Download

memory/1028-1-0x0000000000F90000-0x000000000101C000-memory.dmp

Download

memory/1028-2-0x00000000007C0000-0x0000000000814000-memory.dmp

Download

memory/1028-3-0x0000000074D90000-0x000000007547E000-memory.dmp

Download

memory/1028-4-0x00000000003B0000-0x00000000003B8000-memory.dmp

Download

memory/1028-17-0x0000000074D90000-0x000000007547E000-memory.dmp

Download

memory/2124-13-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-16-0x0000000074D90000-0x000000007547E000-memory.dmp

Download

memory/2124-15-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2124-8-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-7-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-6-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-5-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-11-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2124-18-0x0000000074D90000-0x000000007547E000-memory.dmp

Download