snakekeylogger | 5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
Size

368KB
MD5

51f72822ddf3ea7523d116ff4328c22f
SHA1

70e22a50a272f9cecac73153e812fa9d140edd4d
SHA256

5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9
SHA512

9bc35c63f3fbf48d362d7132925d27880333a13e2cdc2b0cbd9f1040475b410701aa1791504f92559622f44d99ab5cd3ece37ec7b8682685fc86e69b0937540b
SSDEEP

384:OJGY/HAGNn06CjFN8P3YsU6fCWYA8S/hs/E2sofOh/Q0RbnqRGt/KzVtBBU:OJVdNdM8sScR9ApqcAg

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
Zg^!Zy[?IKrs99@soltan

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/3624-1094-0x000001EF5AD70000-0x000001EF5AD94000-memory.dmp	family_snakekeylogger

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3292 created 3372	3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	55

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	checkip.dyndns.org

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
3624	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
Token: SeDebugPrivilege	3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
Token: SeDebugPrivilege	3624	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 3624	3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	91
PID 3292 wrote to memory of 3624	3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	91
PID 3292 wrote to memory of 3624	3292	5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3372
- C:\Users\Admin\AppData\Local\Temp\5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe
  "C:\Users\Admin\AppData\Local\Temp\5f3215ad04a8277ce78a17ea870beb4189e6fee16f36942c25d98ca24e9166e9.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3292-0-0x00007FF9A3A93000-0x00007FF9A3A95000-memory.dmp

Filesize
8KB

Download
memory/3292-1-0x00000195E19C0000-0x00000195E1A20000-memory.dmp

Filesize
384KB

Download
memory/3292-2-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3292-3-0x00000195FC350000-0x00000195FC452000-memory.dmp

Filesize
1.0MB

Download
memory/3292-21-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-27-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-67-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-65-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-63-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-61-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-59-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-57-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-55-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-51-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-49-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-47-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-45-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-43-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-41-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-37-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-35-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-33-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-31-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-29-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-25-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-23-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-19-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-17-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-15-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-13-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-9-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-7-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-5-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-53-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-39-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-11-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-4-0x00000195FC350000-0x00000195FC44B000-memory.dmp

Filesize
1004KB

Download
memory/3292-1078-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1079-0x00000195E37C0000-0x00000195E383C000-memory.dmp

Filesize
496KB

Download
memory/3292-1080-0x00000195E3640000-0x00000195E368C000-memory.dmp

Filesize
304KB

Download
memory/3292-1084-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1085-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1086-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1087-0x00007FF9A3A93000-0x00007FF9A3A95000-memory.dmp

Filesize
8KB

Download
memory/3292-1088-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3292-1089-0x00000195FC450000-0x00000195FC4A4000-memory.dmp

Filesize
336KB

Download
memory/3292-1091-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3624-1092-0x000001EF5A9C0000-0x000001EF5A9E8000-memory.dmp

Filesize
160KB

Download
memory/3624-1093-0x00007FF9A3A93000-0x00007FF9A3A95000-memory.dmp

Filesize
8KB

Download
memory/3624-1094-0x000001EF5AD70000-0x000001EF5AD94000-memory.dmp

Filesize
144KB

Download
memory/3624-1095-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3624-1096-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3624-1097-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download
memory/3624-1100-0x00007FF9A3A90000-0x00007FF9A4551000-memory.dmp

Filesize
10.8MB

Download