snakekeylogger | bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
Size

1.4MB
MD5

a7eb6d75e2e1650b770659935018365b
SHA1

ea305bbda8b4a94cd46c85b322c058f52a3b41f5
SHA256

bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb
SHA512

3487eb0baf2ecb908f2edd65049e1ed0107c318bacb85755e51aa836268f50c7695759d0e165492bc20bbe808337e36b6daf25efb5f7abf4811c16baf6291f5b
SSDEEP

24576:5eyolA3YuCbH7J2Urh6TEJ1Z3PYEAmje+LmSWGn0o5I2W+uJax08B:x3fq0UrhQEJ/MX+x0UIS

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
ABBjy5ce)hyxmj99w
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4896-1194-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
4896	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
Token: SeDebugPrivilege	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
Token: SeDebugPrivilege	4896	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91
PID 2168 wrote to memory of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91
PID 2168 wrote to memory of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91
PID 2168 wrote to memory of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91
PID 2168 wrote to memory of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91
PID 2168 wrote to memory of 4896	2168	bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe	91
PID 4896 wrote to memory of 1812	4896	aspnet_compiler.exe	92
PID 4896 wrote to memory of 1812	4896	aspnet_compiler.exe	92
PID 1812 wrote to memory of 1332	1812	cmd.exe	94
PID 1812 wrote to memory of 1332	1812	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe
"C:\Users\Admin\AppData\Local\Temp\bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:1332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x00007FF9184C3000-0x00007FF9184C5000-memory.dmp

Filesize
8KB

Download
memory/2168-1-0x00000241CC410000-0x00000241CC584000-memory.dmp

Filesize
1.5MB

Download
memory/2168-2-0x00000241E6C90000-0x00000241E6D80000-memory.dmp

Filesize
960KB

Download
memory/2168-3-0x00000241E6E80000-0x00000241E6F70000-memory.dmp

Filesize
960KB

Download
memory/2168-4-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-11-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-14-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-13-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-9-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-8-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-5-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-18-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-24-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-64-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-68-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-66-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-62-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-60-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-58-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-56-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-52-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-50-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-48-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-46-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-44-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-42-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-40-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-38-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-36-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-32-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-30-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-28-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-27-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-22-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-20-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-54-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-16-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-34-0x00000241E6E80000-0x00000241E6F6B000-memory.dmp

Filesize
940KB

Download
memory/2168-1181-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1182-0x00000241CE340000-0x00000241CE3A2000-memory.dmp

Filesize
392KB

Download
memory/2168-1183-0x00000241E6AB0000-0x00000241E6AFC000-memory.dmp

Filesize
304KB

Download
memory/2168-1184-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1185-0x00007FF9184C3000-0x00007FF9184C5000-memory.dmp

Filesize
8KB

Download
memory/2168-1186-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1187-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1188-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1189-0x00000241E6B00000-0x00000241E6B54000-memory.dmp

Filesize
336KB

Download
memory/2168-1191-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/2168-1192-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/4896-1194-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/4896-1193-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/4896-1195-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/4896-1196-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/4896-1197-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download
memory/4896-1199-0x00007FF9184C0000-0x00007FF918F81000-memory.dmp

Filesize
10.8MB

Download