snakekeylogger | 90848c37456f162fccbaf5d52c476fdd73d42522701461bf37a1d55bb31f564b

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_DECQTRA071244PDF.scr.exe
Size

1.5MB
MD5

fecf54a27dcb1e2b7efbebf01a6c6c48
SHA1

d1fe59233d618c9edf97dd138bcdf48dfc3c3f07
SHA256

90848c37456f162fccbaf5d52c476fdd73d42522701461bf37a1d55bb31f564b
SHA512

793addb938b2884e07fc1bcc23a4d5f60c14791c2b42e59d91240a2ee47adc0345d4d9a695bc49953f5eb6653d241dd2e15e83246e3c44c674c16a16f1bd288c
SSDEEP

24576:S45atrPaNBwGaO0bAuLz+uw2B+3ohnqtH0tGf:SCQP4paOQvND+3ohw0t2

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
JOYEss..&UK55@@!!
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral1/memory/5432-1194-0x0000000000D50000-0x0000000000D74000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2096	QUOTATION_DECQTRA071244PDF.scr.exe
5432	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	QUOTATION_DECQTRA071244PDF.scr.exe
Token: SeDebugPrivilege	2096	QUOTATION_DECQTRA071244PDF.scr.exe
Token: SeDebugPrivilege	5432	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 5432	2096	QUOTATION_DECQTRA071244PDF.scr.exe	31
PID 2096 wrote to memory of 5432	2096	QUOTATION_DECQTRA071244PDF.scr.exe	31
PID 2096 wrote to memory of 5432	2096	QUOTATION_DECQTRA071244PDF.scr.exe	31
PID 2096 wrote to memory of 5432	2096	QUOTATION_DECQTRA071244PDF.scr.exe	31
PID 5432 wrote to memory of 5720	5432	aspnet_compiler.exe	33
PID 5432 wrote to memory of 5720	5432	aspnet_compiler.exe	33
PID 5432 wrote to memory of 5720	5432	aspnet_compiler.exe	33
PID 5720 wrote to memory of 5756	5720	cmd.exe	35
PID 5720 wrote to memory of 5756	5720	cmd.exe	35
PID 5720 wrote to memory of 5756	5720	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\QUOTATION_DECQTRA071244PDF.scr.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_DECQTRA071244PDF.scr.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:5756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-0-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000000FD0000-0x000000000114A000-memory.dmp

Filesize
1.5MB

Download
memory/2096-2-0x000000001C110000-0x000000001C21A000-memory.dmp

Filesize
1.0MB

Download
memory/2096-3-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-4-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-11-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-23-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-51-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-67-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-65-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-63-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-61-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-59-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-57-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-55-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-53-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-49-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-47-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-46-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-43-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-41-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-39-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-37-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-35-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-33-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-31-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-29-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-27-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-25-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-21-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-19-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-17-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-15-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-13-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-9-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-7-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-5-0x000000001C110000-0x000000001C214000-memory.dmp

Filesize
1.0MB

Download
memory/2096-1180-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-1181-0x0000000002550000-0x00000000025CC000-memory.dmp

Filesize
496KB

Download
memory/2096-1182-0x0000000000CD0000-0x0000000000D1C000-memory.dmp

Filesize
304KB

Download
memory/2096-1183-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-1184-0x000007FEF5A23000-0x000007FEF5A24000-memory.dmp

Filesize
4KB

Download
memory/2096-1185-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-1186-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-1187-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-1188-0x0000000000F60000-0x0000000000FB4000-memory.dmp

Filesize
336KB

Download
memory/2096-1190-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/2096-1191-0x000007FEF5A20000-0x000007FEF640C000-memory.dmp

Filesize
9.9MB

Download
memory/5432-1192-0x0000000000060000-0x0000000000088000-memory.dmp

Filesize
160KB

Download
memory/5432-1193-0x000007FEF5033000-0x000007FEF5034000-memory.dmp

Filesize
4KB

Download
memory/5432-1194-0x0000000000D50000-0x0000000000D74000-memory.dmp

Filesize
144KB

Download
memory/5432-1196-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

Filesize
9.9MB

Download
memory/5432-1195-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

Filesize
9.9MB

Download
memory/5432-1197-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

Filesize
9.9MB

Download
memory/5432-1198-0x000007FEF5033000-0x000007FEF5034000-memory.dmp

Filesize
4KB

Download
memory/5432-1199-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

Filesize
9.9MB

Download
memory/5432-1200-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

Filesize
9.9MB

Download
memory/5432-1202-0x000007FEF5030000-0x000007FEF5A1C000-memory.dmp

Filesize
9.9MB

Download