Dynamic Malware Analysis Lab from LetsDefend.io platform - Snake KeyLogger
In this analysis lab, I examined a suspicious executable file extracted from a ZIP archive. The sample was later identified as Snake Keylogger, a .NET-based info-stealer first observed in the wild in 2020. Known for its modularity and stealth, Snake Keylogger is designed to steal sensitive information such as user keystrokes, saved browser credentials, Outlook profiles, and even network details like external IP addresses. The malware exfiltrates this data using the SMTP protocol, often by authenticating to a hardcoded mail server with embedded credentials. What makes Snake particularly challenging to detect is its use of process injection - specifically into legitimate Windows system processes like RegSvcs.exe-allowing it to maintain persistence while blending into normal activity. The goal of this lab was to perform a dynamic analysis of the malware, observe its behavior in a controlled environment, and extract indicators of compromise (IOCs) using tools such as Procmon, Wireshark, Fiddler, CyberChef, and AnyRun.
Link to the Lab: [https://app.letsdefend.io/training/lesson_detail/dynamic-malware-analysis-example-2]
To perform the analysis, I used the following tools and environment:
- Virtual Machine: Isolated Windows environment for safe malware execution.
- Process Monitor (Procmon): To observe filesystem, registry, and process activities in real time.
- Wireshark: For capturing and analyzing network traffic generated by the malware.
- Fiddler: To intercept and inspect HTTP/S traffic in detail.
- CyberChef: For decoding Base64 and other encoded data extracted from network streams.
- AnyRun Sandbox: For cross-referencing network and process behaviors reported by the malware in a controlled environment.
- Extracted the malware executable from the ZIP folder.
- Launched the sample on the VM.
- Began monitoring with Procmon to observe real-time process and system calls.
- Started Wireshark to capture network traffic.
(Malware extraction)
(Process Hacker and Procom capturing activity.)
-
Calculated the SHA-256 hash of the malware via Powershell command on the target directory Get-FileHash (filename) to then get the following hash:
85f7f26cd9cfb9ab367d083f60b48e1594b1eadf8dd1a792c347273684855013. -
Queried VirusTotal to identify known detections and gather threat intelligence.
Screenshot 2: VirusTotal results showing malware detections and metadata.
(Malware Bazaar database - Snake KeyLogger malware.)
3.1 - Q - What is the domain name of the web application that the malware is requesting to learn its IP address?
To answer this question we can use various discovery techniques:
- Checking for previous reports on AnyRun, to find that the malware has been previously reported. We run the simulation in the virtual sandbox and we clearly see the answer under the HTTP request tab of the analysis.
- the other method is using Fiddler - a free web debugging proxy tool that allows you to inspect, monitor, and manipulate HTTP and HTTPS traffic between your computer and the internet. By running it, we can clearly see the HTTP request to our target domain.
- We can cross reference the intel found on VirusTotal - the IP traffic generated by the malware, with our Wireshark traffic capture and analyzing it through Statistics > Endpoints tab. I have then cross referenced the IP addresses on the list to the one found in VirusTotal and found the match.
Answer: checkip.dydns.org
Checking on the Connectionstab on AnyRun, we can see the domain names (mail.stilltech.ro)
We find the answer in the same area of the previous question - TCP connects over port 587.
3.4 - Q - What is the username used by the malware to authenticate to the mail server it connects for data hijacking?
We then analyze the Network Stream on our AnyRun analysis by accessing to it via clicking on the 'traffic bar' (check the photo)
and we scroll down the traffic to the packet containing 'AUTH login' followed by b2ZmaWNlQHN0aWxsdGVjaC5ybw==, a Base64 encoded data. We then go and decode the following, leveraging CyberChef - an open-source app for analyzing, decoding, encoding, and transforming data quickly and interactively. By decoding the Base64 data we reveal the login username for to authenticate to the mail server.
(AnyRun Network Stream)
(CyberChef - Decoding Login Auth.)
3.5 - Q - What is the password that the malware uses to authenticate to the mail server it connects for data hijacking?
For the password, it will be the same process: as we move onto the next packets after the AUTH login, we see that another packet of 18b has been sent right before receiving a packet from the server stating 235 Authentication succeeded.
THAT'S OUR PASSWORD, RIGHT THERE.
We follow the same steps as before, and decode it on CyberChef to find that eurobit555ro is the password.
This amazing and interactive lab demonstrated how layered tools and techniques - hash reputation checking, sandbox execution, system monitoring, and network analysis - can be combined to effectively dissect and understand real-world malware samples. Snake Keylogger's ability to inject itself into legitimate processes, establish outbound SMTP connections, and use encoded credentials highlights the need for a multi-faceted approach to threat detection and response.
The exercise reinforced my understanding of dynamic malware analysis workflows and improved my comfort using tools like Procmon, Wireshark, CyberChef, and Fiddler in a real investigation. These tools, when used in conjunction, form a powerful foundation for identifying indicators of compromise and understanding attacker behavior.
I hope you have found this Write-Up insightful and make sure to follow me on all the platform to stay up-to-date with my latest analysis, write-ups and be part of my journey into the world of Cybersecurity! Link: [https://linktr.ee/atlas.protect]