snakekeylogger | 1dbb7ac85b473b9e0cc79d2a523e88d98586642e60f3f9b21ba96fd73a1b6703

Analysis

max time kernel
120s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 10:52

Target

MT STENA IMPRESSION Vessel Particulars.exe
Size

557KB
MD5

c6be69441366e75b3df4a9cea4c7545b
SHA1

26fa365d7607606558bed622bac78ac5c90aed3a
SHA256

1dbb7ac85b473b9e0cc79d2a523e88d98586642e60f3f9b21ba96fd73a1b6703
SHA512

f15af4c55775dd8623eac9dcc7b85ac29303ec3df056ac237d76e4c9cee513934de483e44f3187940a009c7dc358ff8d5b6f5d624903b5ae8f2e2a98d3d393cb
SSDEEP

6144:kdiYBgjxxn1bbti1rMlNPOfgxF9Ld3Bo0f5ofnv+SsR7mO9dsGytWjqbAiZ8Xy7F:kajzn9dRVEvaR7l9dVO

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Snake Keylogger payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2184-10-0x00000000001B0000-0x00000000001D6000-memory.dmp family_snakekeylogger
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

MT STENA IMPRESSION Vessel Particulars.exe

description pid process target process

PID 620 set thread context of 2184 620 MT STENA IMPRESSION Vessel Particulars.exe MT STENA IMPRESSION Vessel Particulars.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2820 2184 WerFault.exe MT STENA IMPRESSION Vessel Particulars.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MT STENA IMPRESSION Vessel Particulars.exe

pid process

2184 MT STENA IMPRESSION Vessel Particulars.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MT STENA IMPRESSION Vessel Particulars.exe

description pid process

Token: SeDebugPrivilege 2184 MT STENA IMPRESSION Vessel Particulars.exe

resource	yara_rule
behavioral2/memory/2184-10-0x00000000001B0000-0x00000000001D6000-memory.dmp	family_snakekeylogger

flow	ioc
2	checkip.dyndns.org

description	pid	process	target process
PID 620 set thread context of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe

pid	pid_target	process	target process
2820	2184	WerFault.exe	MT STENA IMPRESSION Vessel Particulars.exe

pid	process
2184	MT STENA IMPRESSION Vessel Particulars.exe

description	pid	process
Token: SeDebugPrivilege	2184	MT STENA IMPRESSION Vessel Particulars.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

MT STENA IMPRESSION Vessel Particulars.exe

description	pid	process	target process
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe
PID 620 wrote to memory of 2184	620	MT STENA IMPRESSION Vessel Particulars.exe	MT STENA IMPRESSION Vessel Particulars.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 1416
3⤵
- Program crash
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2184 -ip 2184
1⤵
PID:4012

memory/620-5-0x0000000004E90000-0x0000000004EE4000-memory.dmp

Filesize
336KB

Download
memory/620-0-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/620-2-0x0000000005270000-0x0000000005814000-memory.dmp

Filesize
5.6MB

Download
memory/620-3-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/620-4-0x0000000004D10000-0x0000000004D1A000-memory.dmp

Filesize
40KB

Download
memory/620-6-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/620-1-0x00000000002B0000-0x0000000000342000-memory.dmp

Filesize
584KB

Download
memory/620-7-0x0000000004F80000-0x000000000501C000-memory.dmp

Filesize
624KB

Download
memory/620-14-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/620-8-0x0000000004D50000-0x0000000004D58000-memory.dmp

Filesize
32KB

Download
memory/2184-10-0x00000000001B0000-0x00000000001D6000-memory.dmp

Filesize
152KB

Download
memory/2184-12-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2184-11-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/2184-15-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download