snakekeylogger | eaa3954a77e2afe3ff4f533d295619d77f0ab467dd3bb228cfbc87bd592245f1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 06:37

Target

Prouduct list Specifictions.exe
Size

521KB
MD5

9410d7c9e55815baf4a14c3c7542f11e
SHA1

6311d8773c5e2a61cdf98cd2a769f9cfe505aba1
SHA256

eaa3954a77e2afe3ff4f533d295619d77f0ab467dd3bb228cfbc87bd592245f1
SHA512

57c11447573745b13af0cdce59bae0cc53d48ffb14bae5a90c7817e81d385462f1db4611fa3fc1f76682121aceb218d063f012b00a42b0a06e3a9df85eec2167
SSDEEP

12288:c5kndm6oduitZWCxbLzRyCQNuENcSpUbubuF4a0VR9:Hng6oQiSCJM/XPtg4hVR9

Score

10^/10

Family

snakekeylogger

Credentials

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Snake Keylogger payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/2112-9-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Prouduct list Specifictions.exe

description pid process target process

PID 4828 set thread context of 2112 4828 Prouduct list Specifictions.exe Prouduct list Specifictions.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2600 2112 WerFault.exe Prouduct list Specifictions.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Prouduct list Specifictions.exe

pid process

2112 Prouduct list Specifictions.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Prouduct list Specifictions.exe

description pid process

Token: SeDebugPrivilege 2112 Prouduct list Specifictions.exe

resource	yara_rule
behavioral2/memory/2112-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

flow	ioc
6	checkip.dyndns.org

description	pid	process	target process
PID 4828 set thread context of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe

pid	pid_target	process	target process
2600	2112	WerFault.exe	Prouduct list Specifictions.exe

pid	process
2112	Prouduct list Specifictions.exe

description	pid	process
Token: SeDebugPrivilege	2112	Prouduct list Specifictions.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Prouduct list Specifictions.exe

description	pid	process	target process
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe
PID 4828 wrote to memory of 2112	4828	Prouduct list Specifictions.exe	Prouduct list Specifictions.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 1488
3⤵
- Program crash
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 2112
1⤵
PID:1020

memory/2112-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2112-14-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/2112-11-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/2112-10-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4828-3-0x00000000057B0000-0x0000000005842000-memory.dmp

Filesize
584KB

Download
memory/4828-6-0x00000000059B0000-0x0000000005A04000-memory.dmp

Filesize
336KB

Download
memory/4828-5-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4828-7-0x0000000005AB0000-0x0000000005B4C000-memory.dmp

Filesize
624KB

Download
memory/4828-8-0x0000000005A00000-0x0000000005A08000-memory.dmp

Filesize
32KB

Download
memory/4828-4-0x0000000005870000-0x000000000587A000-memory.dmp

Filesize
40KB

Download
memory/4828-0-0x0000000074E6E000-0x0000000074E6F000-memory.dmp

Filesize
4KB

Download
memory/4828-2-0x0000000005D60000-0x0000000006304000-memory.dmp

Filesize
5.6MB

Download
memory/4828-13-0x0000000074E60000-0x0000000075610000-memory.dmp

Filesize
7.7MB

Download
memory/4828-1-0x0000000000CD0000-0x0000000000D58000-memory.dmp

Filesize
544KB

Download