snakekeylogger | 727e7d56eeac2887eb62401a07b781f25d6e0a807fee9e05c5720cc38d0eb5dd

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

motech24062024.pdf.exe
Size

535KB
MD5

902b1157277ecbe3917b85fa905e7f4d
SHA1

6dbb38742564c4f64718e60e5efed146b30b0c83
SHA256

982ce45e891648e586e05d172a32580a141d52a7861dd4afdeebfc20777dcbb3
SHA512

71ef622ca4c59a1ec548cd21f09c40d4c6356a75158dbe54008596988d8bc6ee15926012d2cb97a57f5dbad22f3dadbf5d6f234199e3240edb3814d6fa7f746b
SSDEEP

6144:fx3JWzvWtGwhhvISKQjDNSfZilVj4G5MNklWJ8u//z8K8ICFw7JwHOevcKX3frqg:f3mmhAv4qAlMSMRF8s7yHJv/v+2LuSn

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.mastersharks.com
Port:
587
Username:
[email protected]
Password:
=)!5e%+IUZ$q0bJM
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2904-14-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2904-21-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2904-18-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2904-13-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2904-8-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2904-9-0x0000000000080000-0x00000000000A6000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

motech24062024.pdf.exe

description pid process target process

PID 1960 set thread context of 2904 1960 motech24062024.pdf.exe motech24062024.pdf.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2556 2904 WerFault.exe motech24062024.pdf.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

motech24062024.pdf.exe

pid process

2904 motech24062024.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

motech24062024.pdf.exe

description pid process

Token: SeDebugPrivilege 2904 motech24062024.pdf.exe

description	pid	process	target process
PID 1960 set thread context of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe

pid	pid_target	process	target process
2556	2904	WerFault.exe	motech24062024.pdf.exe

pid	process
2904	motech24062024.pdf.exe

description	pid	process
Token: SeDebugPrivilege	2904	motech24062024.pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

motech24062024.pdf.exemotech24062024.pdf.exe

description	pid	process	target process
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 1960 wrote to memory of 2904	1960	motech24062024.pdf.exe	motech24062024.pdf.exe
PID 2904 wrote to memory of 2556	2904	motech24062024.pdf.exe	WerFault.exe
PID 2904 wrote to memory of 2556	2904	motech24062024.pdf.exe	WerFault.exe
PID 2904 wrote to memory of 2556	2904	motech24062024.pdf.exe	WerFault.exe
PID 2904 wrote to memory of 2556	2904	motech24062024.pdf.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960

C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\motech24062024.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 556
3⤵
- Program crash
PID:2556

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-0-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000000250000-0x00000000002DC000-memory.dmp

Filesize
560KB

Download
memory/1960-2-0x0000000000360000-0x00000000003B4000-memory.dmp

Filesize
336KB

Download
memory/1960-3-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/1960-4-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/1960-23-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2904-18-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-21-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-14-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-13-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-8-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2904-9-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-7-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-22-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download
memory/2904-5-0x0000000000080000-0x00000000000A6000-memory.dmp

Filesize
152KB

Download
memory/2904-24-0x0000000074C20000-0x000000007530E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads