snakekeylogger | 0a0dfd88a061dc8ad13f65954c0c961120bade8ad92f946d10c4bc0bc9c1cf80

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fiyat Teklifi Talebi_22102026.vbs
Size 152KB
Sample261022-e2a34scw3l
SHA256 0a0dfd88a061dc8ad13f65954c0c961120bade8ad92f946d10c4bc0bc9c1cf80
MD5 96964bbcfdd00fcf80cab71072f4aa71
SHA1 0f6e5c5388bebfae43ebbd3c76cefbcc7d45bcb1
SHA512 ed399f17597de0a276d7fdc13cb1f85f8c3c8d268afe7157f02573b669308b006a355275b0ea3924d2edaa7a18a4fb5fde6927fb8e596788c5b4e767e4d3a86d
SSDEEP 3072:ebo9leNNRTSLjE1iA7absrhlU4w0FovBwGfhK8TeNcKhTj0K5ffFHYBHwES2A:11jEM7bYhlUH0UwGJDW7Ic2A
TLSH
T18EE3F16459443FD3A9BD02DF8A5ED86F073510229B99E6883C9F7A8A2773363EF0D405
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution snakekeylogger keylogger persistence stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot8714042194:AAG_8GkJxiY4sU1IdDXt3MUrQN1tLaiphS4/sendMessage?chat_id=7282830258

Signatures

Family: Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/524-18-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Executes dropped EXE 1 IoCs

pid	Process
3892	engine.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2696	certutil.exe
2972	certutil.exe

Looks up external IP address via web service 1 TTPs 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
9	reallyfreegeoip.org
10	reallyfreegeoip.org
1	reallyfreegeoip.org
3	reallyfreegeoip.org
4	reallyfreegeoip.org
5	reallyfreegeoip.org
6	reallyfreegeoip.org
8	reallyfreegeoip.org
1	checkip.dyndns.org
7	reallyfreegeoip.org

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
2148	wscript.exe
4896	WScript.exe
4180	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3892 set thread context of 524	3892	engine.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	engine.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
524	MSBuild.exe
524	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	MSBuild.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4180	4896	WScript.exe	89
PID 4180 wrote to memory of 2148	4180	wscript.exe	90
PID 2148 wrote to memory of 4900	2148	wscript.exe	91
PID 4900 wrote to memory of 1304	4900	cmd.exe	93
PID 2148 wrote to memory of 2696	2148	wscript.exe	94
PID 2148 wrote to memory of 2972	2148	wscript.exe	98
PID 2148 wrote to memory of 3892	2148	wscript.exe	100
PID 3892 wrote to memory of 524	3892	engine.exe	101
PID 3892 wrote to memory of 524	3892	engine.exe	101
PID 3892 wrote to memory of 524	3892	engine.exe	101
PID 3892 wrote to memory of 524	3892	engine.exe	101
PID 3892 wrote to memory of 524	3892	engine.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi Talebi_22102026.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo //e:vbscript "C:\Users\Admin\AppData\Local\Temp\2rk6ld5d.log" "C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi Talebi_22102026.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //e:jscript "C:\Users\Admin\AppData\Local\Temp\svc_60340.tmp" "C:\Users\Admin\AppData\Local\Temp\Fiyat Teklifi Talebi_22102026.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks.exe /create /tn "MediaCacheRefresh" /xml "C:\Users\Admin\AppData\Local\Temp\rad38407.tmp.xml" /f > "C:\Users\Admin\AppData\Local\Temp\schtask_out.txt" 2>&1
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Windows\system32\schtasks.exe
        
        schtasks.exe /create /tn "MediaCacheRefresh" /xml "C:\Users\Admin\AppData\Local\Temp\rad38407.tmp.xml" /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1304
  - - C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\engine.exe.b64" "C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\engine.exe"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:2696
  - - C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\config.bin.b64" "C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\config.bin"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\engine.exe
      "C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\engine.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        5⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:524

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2rk6ld5d.log

Path C:\Users\Admin\AppData\Local\Temp\2rk6ld5d.log
Size 28KB
SHA256 c46c462aee43490f3a64587581982e45b57dd926ce89ed845c5d01162ac07e74
MD5 dd6b52d72c1cf71754634f92f1fe9d11
SHA1 b766f2b879dbccc7f63270e65aa38bbe6b3a7422
SHA512 a8aeb1e1adca1a1322248f6071abd583dcffe0698785683d81c6717f056730a004487856118dc8401dca285fe774453d00cbf47f00ed7f7c31ccf6b7677c926d
SSDEEP 384:8C4db2DEc6thQGAz9B83MsUNw9dBgeQjHqvYqHfiinVJUnT/pdae:8C4dbhQGAX83MnG9dWH29HfbnCp0e
TLSH
T198D25C2625451338E87FC77E88EF480AF9A8F41B68EF1851764C87D92F35045B289FB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rad38407.tmp.xml

Path C:\Users\Admin\AppData\Local\Temp\rad38407.tmp.xml
Size 1KB
SHA256 8cb3c63a8d033f2bc2bda4bf5e766109ecc818193fc3b40fac8ec1e198ccbcb5
MD5 f9d062672f293cfbad56730b233eae90
SHA1 5cdc779c8ded26f48905020e2a560666a7e00c72
SHA512 e88790ff60ad41ad34dc962aff55981fc736c7b92f3606c0acbbe41bf9678f04faf9ef574c55d6451c5d2800c0d691d9654b685efbb0c29df5cdb3cfd1e02fd1
TLSH
T11941794367FE1109F1F36B5CAAB654214EA7FD654C38846D00B8290DCAF3D628960BB7
MD5 SHA1 SHA512 TLSH

Submit Download

config.bin

Path C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\config.bin
Size 52KB
SHA256 b7fea6f4969050ea5a68609b1209ff33470140bfe13cd9f9529e3bd135d4ec3a
MD5 455ebd4778714aca6b2a72af5764a4e5
SHA1 ececbf931e2ab922af859a0764ebc7f2552b5e8e
SHA512 175abdd1ea7ef9f66cc81e446a8da86ab9ee04803685ecbfbbbb8915119e75c3d201629dde91c7622b766dedaecab92dbb12a4c32404ceaba82397dc5f36ec36
SSDEEP 1536:0igt2ClYSw5SsNisry0SU4Rg1VzfjWMCFbhOcd5OJ5j1QJYTM:rI2GYpJUuyhUwoCMCthV5Onj1QJYTM
TLSH
T178330200A4CF86077F62E65F4535A4889A13BD5137565804BEE4F3216386780FE7FB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.bin.b64

Path C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\config.bin.b64
Size 69KB
SHA256 ec186ca756d8bb7cc9a4893959eb34729aa9735f90acf685655b329c262547dc
MD5 dde00e2cf74999116bb1b128d28c757e
SHA1 a437d5491900a7be0f724c41a6958c5f02f29abc
SHA512 28d225ca3115533c23725e078cd22fa6f9177325783c686b9c79125423c268a8bdb944b54a4b6f7a1c2f9df53c5621bcd88acf9caa0c0466ffc0cd41d8ec0538
SSDEEP 1536:WbPRcJ8WG0KGVBFhfk1bpsC2afhfMe3uApk/tJK5o7qjhacbE997wMbxDojSjx7C:WdcJ8WG07VK1bpn205uCeK6+jhacY9Vy
TLSH
T1D26302237A606C82D67425D1249B6E2490281B317DFFC0EABF07C9A5B165E52CB5274F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine.exe

Path C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\engine.exe
Size 17KB
SHA256 210c54212fc97b379d8860343af76bbf88fbdb374ae7ed8ca0a1c5d2290cdc40
MD5 206738cf0b2e2638e2ab11f4a66f606a
SHA1 5538448e7b63fa419ed8365f52e83575e8ce449c
SHA512 e9e32f814cffa0a97fdfd3b9d6b053db032ef066771e476ccd792e6399eb6e7bdb901aaaaeeb4453f44957fcd4166241476f224eb24bcc48db586d315e2935b7
SSDEEP 384:OgngngngMzoBo5AXTFaIBgbtm4iZ7V6HFWAKiNdRT3DhOtN2h6XrP8APl7yqb+j7:pcW8T8SStgSFWAKiNdRT3VOtN2h3EJyR
TLSH
T17C82756A9A42E72BC9A75A3392E643F57870D33109419C2BD5542FF4FF22F85A90432F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine.exe.b64

Path C:\Users\Admin\AppData\Local\Temp\radBAE1B.tmp\engine.exe.b64
Size 23KB
SHA256 4397884b5a7665c449f5014537785490558298e35f6026f0f5e7d46cef7c4dc1
MD5 0840b71f7135e86c765f965d797abae6
SHA1 8d04f78fe76952c840f14abfd67f3f0670be4e31
SHA512 2925fdc7feacbab74803ef1a12b62466d4e3af81ee250a333a81991e8c3f73e1fdfff005bac666c578e5218872f8e5b35b2a9a7bfcf72e99f7867d3103356769
SSDEEP 384:WpGAjg/R9hqaBLOOVkX8BhFO/B/C7CLik5rc7yCH/2j:MGp/R9QcLNyOhFO/JKUXcOt
TLSH
T1BFB2D83591932EC32CAF0ECDD4093CA08D686CB74A389394EDC8C566A7DC5425F5D9EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schtask_out.txt

Path C:\Users\Admin\AppData\Local\Temp\schtask_out.txt
Size 80B
SHA256 49656e023cd97c1129173b68fbbc81faebff8baf6a257af9ef74ef913c9d6ca5
MD5 d6c4db5d7ae243b89baaf54a8b8d7828
SHA1 5a49f594e7e21a397f92309353b251f6aee23ff7
SHA512 0a3343656b720db8ed137a85b4ccd182b550dbd1fb661524427b96617f00062d18c061a5455b1f3b2be8f508974e8e2b9cb34409c781023f06aa54cdb9b17aa7
TLSH
T13DA024F1113003400475D3747C054CC110D030010714314C500FD1FC4444143F3CF043
MD5 SHA1 SHA512 TLSH

Submit Download

svc_60340.tmp

Path C:\Users\Admin\AppData\Local\Temp\svc_60340.tmp
Size 11KB
SHA256 8f0d9e40e9b9aa54513681980cff086b7e693ebe59f509b5ce723c9ab3ee04c9
MD5 18da2b7c00a4547acb66c9324ecea44f
SHA1 43404a2dad53087d728d8311c65f6ed65d2ec334
SHA512 357751c07f955a94c544684b54d8fa5233d3cc69378105634759d9cd6856aaa187a5b54b2942a23f815dd9ca972058773deedf8c68bf44e7e56be819278b9552
SSDEEP 192:vnOd+uYKb7qZNRHYLB7olntVIDGHEzFiLVTZcLPM0iQAQaU6mrRfyyQL0SixA8C3:POdDkQLFetVPHtVTuY04evCQeCQzM2HJ
TLSH
T1BC42C644EB820538B42B45B80F5F400579F2872B2528D4C87EACE9E5AF22B3156FD9FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-18-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/524-19-0x0000000005E40000-0x00000000063FA000-memory.dmp

Download

memory/524-20-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/524-21-0x0000000006BB0000-0x0000000006C00000-memory.dmp

Download

memory/524-22-0x0000000006DD0000-0x0000000006F92000-memory.dmp

Download

memory/524-23-0x0000000006CA0000-0x0000000006D32000-memory.dmp

Download

memory/524-24-0x0000000006C60000-0x0000000006C6A000-memory.dmp

Download