snakekeylogger | 7e2a41007de15f145fd141b8fe26d97be4e3078bc5ae31dce3f7d73a4c330da1

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_DECQTRA071244úPDF.scr
Size

1.4MB
MD5

1a07ab467f5ef0ce3e7733a718538477
SHA1

475792452dd61c6dd023159284b6ae9e0f6581ac
SHA256

7e2a41007de15f145fd141b8fe26d97be4e3078bc5ae31dce3f7d73a4c330da1
SHA512

bc55a5debb917da962a92873797d6421901b10dcc3c75249fadae595cb7db433affc932b87e836ea1b898ce8df0c9e9068a3252eb1d3964100b7d43a574e65df
SSDEEP

24576:3v7/cWsAmR+M9o+NK/Jld5NGXO5GuiJIjNZUAloJZRNcdZtO:3brsXR8+NKx/5NGeENJWN6AmJSdz

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
ABBjy5ce)hyxmj99w
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/1716-1192-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2512	QUOTATION_DECQTRA071244úPDF.scr
2512	QUOTATION_DECQTRA071244úPDF.scr
2512	QUOTATION_DECQTRA071244úPDF.scr
2512	QUOTATION_DECQTRA071244úPDF.scr
1716	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2512	QUOTATION_DECQTRA071244úPDF.scr
Token: SeDebugPrivilege	2512	QUOTATION_DECQTRA071244úPDF.scr
Token: SeDebugPrivilege	1716	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99
PID 2512 wrote to memory of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99
PID 2512 wrote to memory of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99
PID 2512 wrote to memory of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99
PID 2512 wrote to memory of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99
PID 2512 wrote to memory of 1716	2512	QUOTATION_DECQTRA071244úPDF.scr	99
PID 1716 wrote to memory of 2580	1716	aspnet_compiler.exe	101
PID 1716 wrote to memory of 2580	1716	aspnet_compiler.exe	101
PID 2580 wrote to memory of 3452	2580	cmd.exe	103
PID 2580 wrote to memory of 3452	2580	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\QUOTATION_DECQTRA071244úPDF.scr
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_DECQTRA071244úPDF.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-1193-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/1716-1192-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/1716-1195-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/1716-1197-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-0-0x00007FFFDA293000-0x00007FFFDA295000-memory.dmp

Filesize
8KB

Download
memory/2512-1-0x000001C1D9820000-0x000001C1D9986000-memory.dmp

Filesize
1.4MB

Download
memory/2512-2-0x000001C1F3FB0000-0x000001C1F40A0000-memory.dmp

Filesize
960KB

Download
memory/2512-3-0x000001C1F4240000-0x000001C1F4330000-memory.dmp

Filesize
960KB

Download
memory/2512-9-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-24-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-52-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-54-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-68-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-66-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-64-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-62-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-60-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-58-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-56-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-48-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-40-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-38-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-50-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-46-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-44-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-42-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-35-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-30-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-28-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-26-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-22-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-20-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-18-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-17-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-15-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-13-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-11-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-7-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-5-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-4-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-36-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-32-0x000001C1F4240000-0x000001C1F432B000-memory.dmp

Filesize
940KB

Download
memory/2512-1181-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-1182-0x000001C1DB720000-0x000001C1DB782000-memory.dmp

Filesize
392KB

Download
memory/2512-1183-0x000001C1DB780000-0x000001C1DB7CC000-memory.dmp

Filesize
304KB

Download
memory/2512-1184-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-1185-0x00007FFFDA293000-0x00007FFFDA295000-memory.dmp

Filesize
8KB

Download
memory/2512-1186-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-1187-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-1188-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-1189-0x000001C1F40E0000-0x000001C1F4134000-memory.dmp

Filesize
336KB

Download
memory/2512-1191-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download
memory/2512-1194-0x00007FFFDA290000-0x00007FFFDAD51000-memory.dmp

Filesize
10.8MB

Download