snakekeylogger | cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6

Analysis

max time kernel
119s
max time network
33s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe
Size

1.1MB
MD5

7be52418abfdaaaf10ce3445743342e0
SHA1

8382b66c7f96fd1412e61c177b6d4ec86363e684
SHA256

cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6
SHA512

e5a918fc70965c63b2e379bf3cf03adf2cfb6fbf582f41bec1c490e435751416f804c331b56b3eb35c50bafb23947f0fd0c1a967019b246ec0a8e154fdfde0b5
SSDEEP

24576:ffmMv6Ckr7Mny5QLI4Myrq0nGR2O12tKUqxdMT3Bib:f3v+7/5QLs5qO2jKGDq

Score

10^/10

snakekeylogger discovery keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7838879398:AAFzqapOBNplCpztsjMk30H6o5fxblPzSY4/sendMessage?chat_id=7062552884

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 33 IoCs

resource	yara_rule
behavioral1/memory/2764-19-0x0000000000440000-0x000000000047A000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-22-0x0000000000650000-0x0000000000688000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-23-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-24-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-72-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-26-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-28-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-30-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-32-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-34-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-36-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-38-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-40-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-42-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-44-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-46-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-48-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-50-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-52-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-54-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-56-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-58-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-60-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-62-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-64-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-66-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-70-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-82-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-80-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-78-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-76-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-74-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger
behavioral1/memory/2764-68-0x0000000000650000-0x0000000000683000-memory.dmp	family_snakekeylogger

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 1 IoCs

pid	Process
1588	name.exe

Loads dropped DLL 1 IoCs

pid	Process
2996	cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000014b54-4.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 2764	1588	name.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	name.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2764	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1588	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 1588	2996	cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe	28
PID 2996 wrote to memory of 1588	2996	cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe	28
PID 2996 wrote to memory of 1588	2996	cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe	28
PID 2996 wrote to memory of 1588	2996	cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe	28
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 1588 wrote to memory of 2764	1588	name.exe	29
PID 2764 wrote to memory of 980	2764	RegSvcs.exe	32
PID 2764 wrote to memory of 980	2764	RegSvcs.exe	32
PID 2764 wrote to memory of 980	2764	RegSvcs.exe	32
PID 2764 wrote to memory of 980	2764	RegSvcs.exe	32
PID 980 wrote to memory of 2932	980	cmd.exe	34
PID 980 wrote to memory of 2932	980	cmd.exe	34
PID 980 wrote to memory of 2932	980	cmd.exe	34
PID 980 wrote to memory of 2932	980	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe
"C:\Users\Admin\AppData\Local\Temp\cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fascinatress

Filesize
224KB

MD5
05852dbe8d4c7bf2fc195fa15c2136d4

SHA1
78a911827937bb46afe3cbfc94bc07c74a203bcf

SHA256
0658eff257d86b5b7cdcf47d3dbd81a4c1988e23d5de4d1ba49bf7b4f747a6dd

SHA512
3386d16ab49c20cea4bab772e97406be6e936e1a90dd968fc4d2111d7e08f8cf92883f5f3f55a6bf6ddf5729c6fab8f359bfd09e59b2e893c97af1da89589a58

Download Submit
\Users\Admin\AppData\Local\directory\name.exe

Filesize
1.1MB

MD5
7be52418abfdaaaf10ce3445743342e0

SHA1
8382b66c7f96fd1412e61c177b6d4ec86363e684

SHA256
cd1effaef2ebe53cb120fc308084bf8ccdbf9b57e7f0dc5a88af5a372f8721d6

SHA512
e5a918fc70965c63b2e379bf3cf03adf2cfb6fbf582f41bec1c490e435751416f804c331b56b3eb35c50bafb23947f0fd0c1a967019b246ec0a8e154fdfde0b5

Download Submit
memory/1588-12-0x0000000003900000-0x0000000003D00000-memory.dmp

Filesize
4.0MB

Download
memory/2764-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-14-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-17-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-18-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/2764-19-0x0000000000440000-0x000000000047A000-memory.dmp

Filesize
232KB

Download
memory/2764-20-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-21-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-22-0x0000000000650000-0x0000000000688000-memory.dmp

Filesize
224KB

Download
memory/2764-23-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-24-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-72-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-26-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-28-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-30-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-32-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-34-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-36-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-38-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-40-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-42-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-44-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-46-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-48-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-50-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-52-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-54-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-56-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-58-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-60-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-62-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-64-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-66-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-70-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-82-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-80-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-78-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-76-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-74-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-68-0x0000000000650000-0x0000000000683000-memory.dmp

Filesize
204KB

Download
memory/2764-625-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-626-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-627-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/2764-628-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-629-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-630-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2764-631-0x0000000074D20000-0x000000007540E000-memory.dmp

Filesize
6.9MB

Download
memory/2996-2-0x0000000003DB0000-0x00000000041B0000-memory.dmp

Filesize
4.0MB

Download