snakekeylogger | 030c16ffccb55c4a06c3b93d11390e7b2c5b218e220594d45c9fb02f622b856c

Analysis

max time kernel
96s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2025, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zamówienie Z22012914_pdf .scr.exe
Size

30KB
MD5

a3ca0227df6bd50b5003370490c34291
SHA1

4ad313dd3ffb98b09b64b60d7917e7a23f9215f9
SHA256

030c16ffccb55c4a06c3b93d11390e7b2c5b218e220594d45c9fb02f622b856c
SHA512

26c5b2d581d3b4fcb9a9de5b5788aad5a5aea1e565686238e5cc25a011bd6e99e80ccf78f09d9792182233059deb6e31164cb3282d014c5269e01411a1b4021b
SSDEEP

768:pA+1wxzNk46+kBeNpTBZGPz4y/FL7BykIB:pl1wfu+kBeNLuZBykW

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.haselayakkabi.com.tr
Port:
25
Username:
[email protected]
Password:
Ydj5DCO%
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4008-1344-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4724 created 3452	4724	Zamówienie Z22012914_pdf .scr.exe	56

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4724 set thread context of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4724	Zamówienie Z22012914_pdf .scr.exe
4724	Zamówienie Z22012914_pdf .scr.exe
4724	Zamówienie Z22012914_pdf .scr.exe
4008	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	Zamówienie Z22012914_pdf .scr.exe
Token: SeDebugPrivilege	4724	Zamówienie Z22012914_pdf .scr.exe
Token: SeDebugPrivilege	4008	InstallUtil.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86
PID 4724 wrote to memory of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86
PID 4724 wrote to memory of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86
PID 4724 wrote to memory of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86
PID 4724 wrote to memory of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86
PID 4724 wrote to memory of 4008	4724	Zamówienie Z22012914_pdf .scr.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\Zamówienie Z22012914_pdf .scr.exe
  "C:\Users\Admin\AppData\Local\Temp\Zamówienie Z22012914_pdf .scr.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4008-1344-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/4008-1347-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4008-1346-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4008-1348-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-0-0x00007FFE75BF3000-0x00007FFE75BF5000-memory.dmp

Filesize
8KB

Download
memory/4724-1-0x00000126CD1A0000-0x00000126CD1AA000-memory.dmp

Filesize
40KB

Download
memory/4724-2-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-3-0x00000126E78C0000-0x00000126E79C8000-memory.dmp

Filesize
1.0MB

Download
memory/4724-19-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-23-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-67-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-65-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-63-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-61-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-59-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-57-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-55-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-51-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-49-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-47-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-45-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-43-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-41-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-39-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-35-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-33-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-31-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-29-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-27-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-25-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-21-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-17-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-15-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-13-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-11-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-9-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-7-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-53-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-5-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-37-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-4-0x00000126E78C0000-0x00000126E79C2000-memory.dmp

Filesize
1.0MB

Download
memory/4724-1326-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1327-0x00000126CEF30000-0x00000126CEF92000-memory.dmp

Filesize
392KB

Download
memory/4724-1328-0x00000126E79D0000-0x00000126E7A2E000-memory.dmp

Filesize
376KB

Download
memory/4724-1329-0x00007FFE75BF3000-0x00007FFE75BF5000-memory.dmp

Filesize
8KB

Download
memory/4724-1330-0x00000126E7AA0000-0x00000126E7AEC000-memory.dmp

Filesize
304KB

Download
memory/4724-1331-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1332-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1333-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1334-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1335-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1336-0x00000126E8BA0000-0x00000126E8BF4000-memory.dmp

Filesize
336KB

Download
memory/4724-1341-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1345-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-1343-0x00007FFE75BF0000-0x00007FFE766B1000-memory.dmp

Filesize
10.8MB

Download