snakekeylogger | 4921525fdbec4c32c91dcbda29c6abafa6abb1965c89907aa1c3ffc5dcc35c61

Analysis

max time kernel
123s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-07-2024 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEW ORDER.19022021.exe
Size

680KB
MD5

b66330a8ce88bf8289252f2d1fba8c36
SHA1

f6f6fbd9abb724a9b669415f03e0ee10516e736d
SHA256

8cfafa2cbc8c24afe00f82ca7beef18000cd3ad1a2f45c97a0a6e1921df0c92f
SHA512

565e47f13578cf3f96d65294e2613b9d0d888faf50bdb37ff89b44f24b3b4630c3325bc2e36a2eab2fcadf1301ae59b7112977fc9605e05deafac0ae7b7c09b5
SSDEEP

12288:BEz6hGceTorDIW87RfD4dGGsX/evWmZi0elxw1I9xI/RYhl7wFzo/j:fBr0W8mdGoOmclN9+ml+o/

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot1599185091:AAFwjZ99E4P1IuAWSo1Ue568J97WLOPoV88/sendMessage?chat_id=652007142

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 2308	2692	NEW ORDER.19022021.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2308	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31
PID 2692 wrote to memory of 2308	2692	NEW ORDER.19022021.exe	31

C:\Users\Admin\AppData\Local\Temp\NEW ORDER.19022021.exe
"C:\Users\Admin\AppData\Local\Temp\NEW ORDER.19022021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-16-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-14-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-8-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-7-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-19-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2308-17-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2308-9-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-10-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-12-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2308-20-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2308-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-2-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-0-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/2692-1-0x0000000000AC0000-0x0000000000B70000-memory.dmp

Filesize
704KB

Download
memory/2692-6-0x0000000008D70000-0x000000000929E000-memory.dmp

Filesize
5.2MB

Download
memory/2692-5-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-18-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2692-4-0x0000000074C9E000-0x0000000074C9F000-memory.dmp

Filesize
4KB

Download
memory/2692-3-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download