snakekeylogger | 8d112382b7f4f02f89697b7a14e7ece8efabd3da0904c8022240234c879d6d99

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 11:28

Target

AWB 1311072431.exe
Size

595KB
MD5

e88f6d971224d6404d0112b74fcb7591
SHA1

5a24fb72a1c4072f60bb11f58c2a1c65e25c6d9d
SHA256

e166bffdc266ce0a49b5bf35f3932696892d5dd1a6aecc5b805c95523f13b219
SHA512

8ee660a62e6be76bdf79039c808e994b8001ebad69c84a8b57c4730321038805eb72603ba4bad1b653fbf4fe027ba284ef4547dee6a2d98b41b72117868a9092
SSDEEP

12288:6BXlmEOvkROhYI28EYr+seD48DoklCpR17M6pX1aD1jgp:6qEGo8ER48DoXn1bs

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2332-7-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 460 set thread context of 2332	460	AWB 1311072431.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
460	AWB 1311072431.exe
2332	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	460	AWB 1311072431.exe
Token: SeDebugPrivilege	2332	RegSvcs.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 2332	460	AWB 1311072431.exe	93
PID 460 wrote to memory of 2332	460	AWB 1311072431.exe	93
PID 460 wrote to memory of 2332	460	AWB 1311072431.exe	93
PID 460 wrote to memory of 2332	460	AWB 1311072431.exe	93
PID 460 wrote to memory of 2332	460	AWB 1311072431.exe	93
PID 460 wrote to memory of 2332	460	AWB 1311072431.exe	93
PID 2332 wrote to memory of 1664	2332	RegSvcs.exe	95
PID 2332 wrote to memory of 1664	2332	RegSvcs.exe	95
PID 1664 wrote to memory of 1040	1664	cmd.exe	97
PID 1664 wrote to memory of 1040	1664	cmd.exe	97

memory/460-6-0x000000001D850000-0x000000001D8B6000-memory.dmp

Filesize
408KB

Download
memory/460-1-0x00007FFA03233000-0x00007FFA03235000-memory.dmp

Filesize
8KB

Download
memory/460-2-0x00007FFA03230000-0x00007FFA03CF1000-memory.dmp

Filesize
10.8MB

Download
memory/460-3-0x0000000003500000-0x0000000003524000-memory.dmp

Filesize
144KB

Download
memory/460-5-0x0000000003540000-0x0000000003554000-memory.dmp

Filesize
80KB

Download
memory/460-4-0x0000000003520000-0x0000000003536000-memory.dmp

Filesize
88KB

Download
memory/460-0-0x0000000000A20000-0x0000000000AB8000-memory.dmp

Filesize
608KB

Download
memory/460-9-0x000000001C7D0000-0x000000001C979000-memory.dmp

Filesize
1.7MB

Download
memory/460-11-0x00007FFA03230000-0x00007FFA03CF1000-memory.dmp

Filesize
10.8MB

Download
memory/2332-7-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/2332-12-0x00007FFA03230000-0x00007FFA03CF1000-memory.dmp

Filesize
10.8MB

Download
memory/2332-13-0x00007FFA03230000-0x00007FFA03CF1000-memory.dmp

Filesize
10.8MB

Download
memory/2332-15-0x00007FFA03230000-0x00007FFA03CF1000-memory.dmp

Filesize
10.8MB

Download