snakekeylogger | 8d112382b7f4f02f89697b7a14e7ece8efabd3da0904c8022240234c879d6d99

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB 1311072431.exe
Size

595KB
MD5

e88f6d971224d6404d0112b74fcb7591
SHA1

5a24fb72a1c4072f60bb11f58c2a1c65e25c6d9d
SHA256

e166bffdc266ce0a49b5bf35f3932696892d5dd1a6aecc5b805c95523f13b219
SHA512

8ee660a62e6be76bdf79039c808e994b8001ebad69c84a8b57c4730321038805eb72603ba4bad1b653fbf4fe027ba284ef4547dee6a2d98b41b72117868a9092
SSDEEP

12288:6BXlmEOvkROhYI28EYr+seD48DoklCpR17M6pX1aD1jgp:6qEGo8ER48DoXn1bs

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.innovativeenqg.co.in
Port:
25
Username:
[email protected]
Password:
%OTz$v%9
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

resource	yara_rule
behavioral1/memory/3048-12-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger
behavioral1/memory/3048-9-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 3048	2356	AWB 1311072431.exe	31

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2356	AWB 1311072431.exe
3048	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	AWB 1311072431.exe
Token: SeDebugPrivilege	3048	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 2356 wrote to memory of 3048	2356	AWB 1311072431.exe	31
PID 3048 wrote to memory of 2716	3048	RegSvcs.exe	32
PID 3048 wrote to memory of 2716	3048	RegSvcs.exe	32
PID 3048 wrote to memory of 2716	3048	RegSvcs.exe	32
PID 2716 wrote to memory of 2648	2716	cmd.exe	34
PID 2716 wrote to memory of 2648	2716	cmd.exe	34
PID 2716 wrote to memory of 2648	2716	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\AWB 1311072431.exe
"C:\Users\Admin\AppData\Local\Temp\AWB 1311072431.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-0-0x000007FEF5793000-0x000007FEF5794000-memory.dmp

Filesize
4KB

Download
memory/2356-1-0x000000013FBA0000-0x000000013FC38000-memory.dmp

Filesize
608KB

Download
memory/2356-2-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2356-3-0x0000000000740000-0x0000000000764000-memory.dmp

Filesize
144KB

Download
memory/2356-4-0x00000000008E0000-0x00000000008F6000-memory.dmp

Filesize
88KB

Download
memory/2356-5-0x0000000000170000-0x0000000000184000-memory.dmp

Filesize
80KB

Download
memory/2356-6-0x000000001B370000-0x000000001B3D6000-memory.dmp

Filesize
408KB

Download
memory/2356-15-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-12-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/3048-10-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

Filesize
4KB

Download
memory/3048-9-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/3048-8-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/3048-16-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-7-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/3048-17-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-18-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-19-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/3048-20-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download