snakekeylogger | 4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

max time kernel
103s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2025, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f62837f3bc66012b94d74cc471f3d97a.exe
Size 625KB
Sample250425-ryf66svsby
SHA256 6831200eb1173e4bf699042b7b2e63e3582490981a55b20671724bb60cb0faa9
MD5 f62837f3bc66012b94d74cc471f3d97a
SHA1 9fa01c1c57bb1ec604771a796b4c36352552516f
SHA512 de95cd3184e9f9d6931db60a6edd6e986eba3ae0c2e6308e65808aa6fbefd4d00f0d38a4305dc307d0217acdfe8fad165adf7a39d6f553eb53ff81abbb147b6a
SSDEEP 12288:jQn+P/KKZA6B0Ndprctmm0+xFLnLsoc/8uHlHXob3:W+P/0UWdomC/LnLsoc0uHdX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger discovery execution keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7810553983:AAF3uNmTjPchWZALCr5hfHzaUc2KfKr7BrQ/sendMessage?chat_id=8164035448

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral4/memory/3096-46-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4988	powershell.exe
5060	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	f62837f3bc66012b94d74cc471f3d97a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	f62837f3bc66012b94d74cc471f3d97a.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	checkip.dyndns.org
28	reallyfreegeoip.org
29	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2700 set thread context of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f62837f3bc66012b94d74cc471f3d97a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f62837f3bc66012b94d74cc471f3d97a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2700	f62837f3bc66012b94d74cc471f3d97a.exe
2700	f62837f3bc66012b94d74cc471f3d97a.exe
2700	f62837f3bc66012b94d74cc471f3d97a.exe
2700	f62837f3bc66012b94d74cc471f3d97a.exe
2700	f62837f3bc66012b94d74cc471f3d97a.exe
2700	f62837f3bc66012b94d74cc471f3d97a.exe
4988	powershell.exe
5060	powershell.exe
2700	f62837f3bc66012b94d74cc471f3d97a.exe
5060	powershell.exe
3096	f62837f3bc66012b94d74cc471f3d97a.exe
4988	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	f62837f3bc66012b94d74cc471f3d97a.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	3096	f62837f3bc66012b94d74cc471f3d97a.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4988	2700	f62837f3bc66012b94d74cc471f3d97a.exe	94
PID 2700 wrote to memory of 4988	2700	f62837f3bc66012b94d74cc471f3d97a.exe	94
PID 2700 wrote to memory of 4988	2700	f62837f3bc66012b94d74cc471f3d97a.exe	94
PID 2700 wrote to memory of 5060	2700	f62837f3bc66012b94d74cc471f3d97a.exe	96
PID 2700 wrote to memory of 5060	2700	f62837f3bc66012b94d74cc471f3d97a.exe	96
PID 2700 wrote to memory of 5060	2700	f62837f3bc66012b94d74cc471f3d97a.exe	96
PID 2700 wrote to memory of 1420	2700	f62837f3bc66012b94d74cc471f3d97a.exe	98
PID 2700 wrote to memory of 1420	2700	f62837f3bc66012b94d74cc471f3d97a.exe	98
PID 2700 wrote to memory of 1420	2700	f62837f3bc66012b94d74cc471f3d97a.exe	98
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 2700 wrote to memory of 3096	2700	f62837f3bc66012b94d74cc471f3d97a.exe	100
PID 3096 wrote to memory of 5644	3096	f62837f3bc66012b94d74cc471f3d97a.exe	103
PID 3096 wrote to memory of 5644	3096	f62837f3bc66012b94d74cc471f3d97a.exe	103
PID 3096 wrote to memory of 5644	3096	f62837f3bc66012b94d74cc471f3d97a.exe	103
PID 5644 wrote to memory of 5640	5644	cmd.exe	105
PID 5644 wrote to memory of 5640	5644	cmd.exe	105
PID 5644 wrote to memory of 5640	5644	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a.exe
"C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RfmuHLHAcxv.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RfmuHLHAcxv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF23.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a.exe
  "C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\f62837f3bc66012b94d74cc471f3d97a.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f62837f3bc66012b94d74cc471f3d97a.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f62837f3bc66012b94d74cc471f3d97a.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 ad25bf4a380f76b1bc5615d8629d5bfa674bba7ca300765e9f0d2d80ca9956d7
MD5 91f4555e415f42f73d57c2a8558dd788
SHA1 fac34db67d94d05101cf7d8a1e3d49803b680b49
SHA512 5f5b79c176e384d865c52f0d6845c428010eb4da038cb899381ee83f029e33fdc68dafa498e40cdefa23c82e39d0f9c22928f6b8a0f245ed91684fce168f587b
SSDEEP 384:rsf+BR9i+F3lU0VzJk6yo9o2TJK6seYLME/N03SoZefYSgAjEDk2Q0gdMtkKhD:wfIVTe6Ho2TJNgr2S5W+ED7Cm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_oplp4zv3.f3x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oplp4zv3.f3x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpEF23.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpEF23.tmp
Size 1KB
SHA256 d9a1f3758aca8c54bac7101010c893245e4a7f665027179d6525280796dc6cf3
MD5 4925d4009d6a070d70a7b2b5efb6353e
SHA1 8709e2a075ddfe645c860b37aed90472920dec11
SHA512 38f102e7f901f3800c099e9713c6159c77ecbea1e3677bacb4ea3d04769a7b6c6a20768d24f029bf8ca084319345a90019134380b0425a0a52c5a0d18a72f3e6
MD5 SHA1 SHA512

Submit Download

memory/2700-8-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2700-6-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/2700-7-0x00000000751EE000-0x00000000751EF000-memory.dmp

Download

memory/2700-4-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2700-9-0x0000000005FA0000-0x000000000600A000-memory.dmp

Download

memory/2700-10-0x00000000061F0000-0x000000000628C000-memory.dmp

Download

memory/2700-5-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Download

memory/2700-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

Download

memory/2700-3-0x0000000004E40000-0x0000000004ED2000-memory.dmp

Download

memory/2700-2-0x00000000053F0000-0x0000000005994000-memory.dmp

Download

memory/2700-48-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/2700-1-0x0000000000430000-0x00000000004D2000-memory.dmp

Download

memory/3096-46-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4988-16-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/4988-64-0x0000000075A40000-0x0000000075A8C000-memory.dmp

Download

memory/4988-28-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/4988-29-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/4988-27-0x0000000005480000-0x00000000054A2000-memory.dmp

Download

memory/4988-45-0x0000000005D40000-0x0000000006094000-memory.dmp

Download

memory/4988-15-0x0000000004D50000-0x0000000004D86000-memory.dmp

Download

memory/4988-17-0x00000000054C0000-0x0000000005AE8000-memory.dmp

Download

memory/4988-19-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/4988-18-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/4988-85-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/4988-82-0x0000000007970000-0x0000000007978000-memory.dmp

Download

memory/4988-81-0x0000000007990000-0x00000000079AA000-memory.dmp

Download

memory/4988-78-0x0000000007850000-0x0000000007861000-memory.dmp

Download

memory/4988-77-0x00000000078D0000-0x0000000007966000-memory.dmp

Download

memory/5060-79-0x0000000007300000-0x000000000730E000-memory.dmp

Download

memory/5060-50-0x0000000005E50000-0x0000000005E9C000-memory.dmp

Download

memory/5060-74-0x0000000007710000-0x0000000007D8A000-memory.dmp

Download

memory/5060-76-0x0000000007140000-0x000000000714A000-memory.dmp

Download

memory/5060-63-0x0000000006F90000-0x0000000007033000-memory.dmp

Download

memory/5060-51-0x0000000006D50000-0x0000000006D82000-memory.dmp

Download

memory/5060-75-0x00000000070D0000-0x00000000070EA000-memory.dmp

Download

memory/5060-62-0x0000000006D30000-0x0000000006D4E000-memory.dmp

Download

memory/5060-30-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/5060-52-0x0000000075A40000-0x0000000075A8C000-memory.dmp

Download

memory/5060-80-0x0000000007310000-0x0000000007324000-memory.dmp

Download

memory/5060-49-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

Download

memory/5060-20-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/5060-89-0x00000000751E0000-0x0000000075990000-memory.dmp

Download

memory/5060-21-0x00000000751E0000-0x0000000075990000-memory.dmp

Download