snakekeylogger | 140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
Size

605KB
MD5

7b6d9d0893e80f7384d76e276a55c45d
SHA1

00550e16c24efa4f9b1d5f8f7ff8b9f2cb009f03
SHA256

140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4
SHA512

63471530356734e390db5e8cb3ee7d0a04a09a9c76caf3f4b44040e07d05add0e122340fb7f2b7db773316ef9d2988b1778dac86fc9c8a6871ec876cf3024498
SSDEEP

12288:83bzRG0DQe+i8BfL55Db2HrD7w/u/WNYAfdyeSYjRr5dbRe:qMiYIr2BaOdyeSYhF

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.curtainstore.ae
Port:
587
Username:
[email protected]
Password:
omar123$$
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Snake Keylogger payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers

resource	yara_rule
behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

resource	yara_rule
behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with SmartAssembly 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3272-7-0x00000000063E0000-0x00000000063F0000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/3272-8-0x0000000006410000-0x000000000641C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
Detects executables with potential process hoocking 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DotNetProcHook
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 checkip.dyndns.org

resource	yara_rule
behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

resource	yara_rule
behavioral2/memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook

flow	ioc
5	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

description	pid	process	target process
PID 3272 set thread context of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1968 4024 WerFault.exe 140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

pid process

4024 140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

description pid process

Token: SeDebugPrivilege 4024 140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

pid	pid_target	process	target process
1968	4024	WerFault.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

pid	process
4024	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

description	pid	process
Token: SeDebugPrivilege	4024	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

description	pid	process	target process
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
PID 3272 wrote to memory of 4024	3272	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe	140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe

C:\Users\Admin\AppData\Local\Temp\140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
"C:\Users\Admin\AppData\Local\Temp\140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3272

C:\Users\Admin\AppData\Local\Temp\140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe
"C:\Users\Admin\AppData\Local\Temp\140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1448
3⤵
- Program crash
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4024 -ip 4024
1⤵
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\140a5535a35a820de41ed7441f1278898247a6adbc2594d8a1f34bd9f4715eb4.exe.log
Filesize
1KB

MD5
31f95c36ee4b5ac1ffcbdc89b3bcabc0

SHA1
d38fddab78283c1cc05cc55652222cd7e5a484aa

SHA256
88486792973340aafc9db775eadfaa849d05a5e2ed25a38e67febcdf70213ce6

SHA512
9acb665346143d8622613d047502a65615ea369db94281b20cb5bea6dac18f397f8c0144e8d4a201d94cd36b229ad9a31ce4a4a11e1fdcd19e6496a035032072

Download Submit
memory/3272-4-0x0000000004A40000-0x0000000004A4A000-memory.dmp

Filesize
40KB

Download
memory/3272-7-0x00000000063E0000-0x00000000063F0000-memory.dmp

Filesize
64KB

Download
memory/3272-3-0x0000000005060000-0x0000000005604000-memory.dmp

Filesize
5.6MB

Download
memory/3272-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/3272-9-0x00000000066B0000-0x0000000006718000-memory.dmp

Filesize
416KB

Download
memory/3272-6-0x0000000006360000-0x00000000063DA000-memory.dmp

Filesize
488KB

Download
memory/3272-2-0x0000000004980000-0x0000000004A12000-memory.dmp

Filesize
584KB

Download
memory/3272-8-0x0000000006410000-0x000000000641C000-memory.dmp

Filesize
48KB

Download
memory/3272-5-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/3272-10-0x00000000064C0000-0x000000000655C000-memory.dmp

Filesize
624KB

Download
memory/3272-14-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/3272-1-0x0000000000040000-0x00000000000DE000-memory.dmp

Filesize
632KB

Download
memory/4024-15-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4024-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4024-16-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4024-17-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download