snakekeylogger | 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 01:39

Target

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
Size

535KB
MD5

902b1157277ecbe3917b85fa905e7f4d
SHA1

6dbb38742564c4f64718e60e5efed146b30b0c83
SHA256

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3
SHA512

71ef622ca4c59a1ec548cd21f09c40d4c6356a75158dbe54008596988d8bc6ee15926012d2cb97a57f5dbad22f3dadbf5d6f234199e3240edb3814d6fa7f746b
SSDEEP

6144:fx3JWzvWtGwhhvISKQjDNSfZilVj4G5MNklWJ8u//z8K8ICFw7JwHOevcKX3frqg:f3mmhAv4qAlMSMRF8s7yHJv/v+2LuSn

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Snake Keylogger payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers
Detects executables with potential process hoocking 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

resource	yara_rule
behavioral2/memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

resource	yara_rule
behavioral2/memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

resource	yara_rule
behavioral2/memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

Suspicious use of SetThreadContext 1 IoCs

Processes:

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

description	pid	process	target process
PID 2188 set thread context of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4808 3272 WerFault.exe 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

pid process

3272 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

description pid process

Token: SeDebugPrivilege 3272 982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

pid	pid_target	process	target process
4808	3272	WerFault.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

pid	process
3272	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

description	pid	process
Token: SeDebugPrivilege	3272	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

description	pid	process	target process
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe
PID 2188 wrote to memory of 3272	2188	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe	982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 804
3⤵
- Program crash
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3272 -ip 3272
1⤵
PID:2952

memory/2188-6-0x00000000056B0000-0x0000000005704000-memory.dmp

Filesize
336KB

Download
memory/2188-1-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Filesize
560KB

Download
memory/2188-2-0x0000000005A60000-0x0000000006004000-memory.dmp

Filesize
5.6MB

Download
memory/2188-3-0x0000000005590000-0x0000000005622000-memory.dmp

Filesize
584KB

Download
memory/2188-4-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/2188-5-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/2188-0-0x0000000074C8E000-0x0000000074C8F000-memory.dmp

Filesize
4KB

Download
memory/2188-7-0x00000000058F0000-0x000000000598C000-memory.dmp

Filesize
624KB

Download
memory/2188-8-0x0000000005740000-0x0000000005748000-memory.dmp

Filesize
32KB

Download
memory/2188-12-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/3272-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3272-10-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/3272-13-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download