snakekeylogger | 7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2025, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
Size

10KB
MD5

fd7634082a916c3bd8c94c8493fc83e2
SHA1

c60c2abf158cc15b775d147b3daeffe7ca620d66
SHA256

7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d
SHA512

dec560e299ed874f87271aba3c597b0ad09d7b2a7d30f2024ef16ae85f8bca3cfce631e207d23eaaf9bd22f61f916474e5e21710c2b275556a16a7549158d49d
SSDEEP

192:S+SaZG1g6f0CX6I8VBoTruapz7as7wl5N+2:pSaZFyL6I8VAt7alQ

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7719158406:AAGxGMuZ_5NEFP89HZrIghiOEjJFOaEE7ds/sendMessage?chat_id=1018401531

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/6060-1344-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4944 created 3576	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	56

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4944 set thread context of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
6060	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
Token: SeDebugPrivilege	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
Token: SeDebugPrivilege	6060	InstallUtil.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95
PID 4944 wrote to memory of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95
PID 4944 wrote to memory of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95
PID 4944 wrote to memory of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95
PID 4944 wrote to memory of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95
PID 4944 wrote to memory of 6060	4944	7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3576
- C:\Users\Admin\AppData\Local\Temp\7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe
  "C:\Users\Admin\AppData\Local\Temp\7a5a195be41d691882da0610b142ab0f82b6cccfa5b66db38b5a2416f5e4b62d.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4944-1-0x00000293B42D0000-0x00000293B42D6000-memory.dmp

Filesize
24KB

Download
memory/4944-0-0x00007FFCFB8A3000-0x00007FFCFB8A5000-memory.dmp

Filesize
8KB

Download
memory/4944-2-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-3-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-4-0x00000293CE900000-0x00000293CEA0A000-memory.dmp

Filesize
1.0MB

Download
memory/4944-20-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-24-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-68-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-66-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-64-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-62-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-60-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-58-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-56-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-54-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-52-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-50-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-46-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-44-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-42-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-40-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-38-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-36-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-34-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-32-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-30-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-28-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-26-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-22-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-18-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-16-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-14-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-13-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-8-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-6-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-48-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-10-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-5-0x00000293CE900000-0x00000293CEA03000-memory.dmp

Filesize
1.0MB

Download
memory/4944-1327-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1328-0x00000293CFAD0000-0x00000293CFB32000-memory.dmp

Filesize
392KB

Download
memory/4944-1329-0x00000293CFB30000-0x00000293CFB90000-memory.dmp

Filesize
384KB

Download
memory/4944-1331-0x00000293CFC50000-0x00000293CFC9C000-memory.dmp

Filesize
304KB

Download
memory/4944-1330-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1332-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1333-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1334-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1335-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1336-0x00000293CFCA0000-0x00000293CFCF4000-memory.dmp

Filesize
336KB

Download
memory/4944-1341-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1345-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/4944-1343-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/6060-1344-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/6060-1346-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/6060-1347-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download
memory/6060-1348-0x00007FFCFB8A0000-0x00007FFCFC361000-memory.dmp

Filesize
10.8MB

Download