snakekeylogger | 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3

Analysis

max time kernel
140s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
motech24062024.pdf.exe
Size 535KB
Sample240624-nbzhfssfpp
SHA256 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3
MD5 902b1157277ecbe3917b85fa905e7f4d
SHA1 6dbb38742564c4f64718e60e5efed146b30b0c83
SHA512 71ef622ca4c59a1ec548cd21f09c40d4c6356a75158dbe54008596988d8bc6ee15926012d2cb97a57f5dbad22f3dadbf5d6f234199e3240edb3814d6fa7f746b
SSDEEP 6144:fx3JWzvWtGwhhvISKQjDNSfZilVj4G5MNklWJ8u//z8K8ICFw7JwHOevcKX3frqg:f3mmhAv4qAlMSMRF8s7yHJv/v+2LuSn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.mastersharks.com
Port
587
Username
[email protected]
Password
=)!5e%+IUZ$q0bJM
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2700-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1224 set thread context of 2700	1224	motech24062024.pdf.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1620	2700	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2700	motech24062024.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	motech24062024.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83
PID 1224 wrote to memory of 2700	1224	motech24062024.pdf.exe	83

C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 800
    3⤵
    - Program crash
    PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2700 -ip 2700
1⤵
PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-5-0x0000000005280000-0x00000000052D4000-memory.dmp

Download

memory/1224-1-0x0000000000610000-0x000000000069C000-memory.dmp

Download

memory/1224-2-0x0000000005610000-0x0000000005BB4000-memory.dmp

Download

memory/1224-3-0x0000000005060000-0x00000000050F2000-memory.dmp

Download

memory/1224-4-0x0000000005270000-0x000000000527A000-memory.dmp

Download

memory/1224-6-0x0000000075010000-0x00000000757C0000-memory.dmp

Download

memory/1224-0-0x000000007501E000-0x000000007501F000-memory.dmp

Download

memory/1224-7-0x0000000005420000-0x00000000054BC000-memory.dmp

Download

memory/1224-8-0x0000000005300000-0x0000000005308000-memory.dmp

Download

memory/1224-12-0x0000000075010000-0x00000000757C0000-memory.dmp

Download

memory/2700-9-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/2700-10-0x0000000075010000-0x00000000757C0000-memory.dmp

Download

memory/2700-13-0x0000000075010000-0x00000000757C0000-memory.dmp

Download