Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 14:36
Behavioral task
behavioral1
Sample
cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe
Resource
win10v2004-20241007-en
General
-
Target
cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe
-
Size
131KB
-
MD5
4634e3e6584b3f6f79c63b718dcd858c
-
SHA1
2a540ad0f78d989a4a32521354aaa7ec65a83a9e
-
SHA256
cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87
-
SHA512
3e5246d594069ba469cf26dc8002e0020a874b2f0ceac25d31b5dcdbf6aca46901c7409a227460c3ff532cebfdd3f0009ad898b76cf5e97c5024761a0b1fdf52
-
SSDEEP
3072:nq/6fidzVhevEzfPUilnb51D5sLCwvxpJgbY:q2i5ckbD8Cb
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.damaz.it - Port:
587 - Username:
[email protected] - Password:
348cli - Email To:
[email protected]
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral1/memory/1836-1-0x00000000010D0000-0x00000000010F6000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Deletes itself 1 IoCs
pid Process 2736 cmd.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org 8 reallyfreegeoip.org 9 reallyfreegeoip.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1836 cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1836 cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1836 wrote to memory of 2736 1836 cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe 31 PID 1836 wrote to memory of 2736 1836 cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe 31 PID 1836 wrote to memory of 2736 1836 cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe 31 PID 1836 wrote to memory of 2736 1836 cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe 31 PID 2736 wrote to memory of 2780 2736 cmd.exe 33 PID 2736 wrote to memory of 2780 2736 cmd.exe 33 PID 2736 wrote to memory of 2780 2736 cmd.exe 33 PID 2736 wrote to memory of 2780 2736 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe"C:\Users\Admin\AppData\Local\Temp\cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\cb84dc0df43c3fe063e43f547dd9678ffa8c054ba955f98bf35c9a8581be5c87.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
- System Location Discovery: System Language Discovery
PID:2780
-
-