File name:

pet.exe

Full analysis: https://app.any.run/tasks/7f4cb38a-eb9e-4123-b26c-727424a7a387
Verdict: Malicious activity
Analysis date: November 09, 2023, 17:42:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
snake
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

C6184A0858570AB06401A2D9A7ABB84C

SHA1:

5DB26522798AFBC174087C44FA4A7C233B4EB9B1

SHA256:

7ED99EB3221D685130AC3695222E9025DD62E2880F3AF360140EF1D0532E80E3

SSDEEP:

6144:7ErI76O311TFj05FJO3Cu7Hjl5Qzb2+7M02wMPnz1TCnadO9IM9E1fET9eDy7f5o:ZPCu7HjohDtYz1RoGEEk9yy2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Powershell.exe (PID: 3460)

    • Bypass execution policy to execute commands

      • Powershell.exe (PID: 3460)

    • Drops the executable file immediately after the start

      • Powershell.exe (PID: 3460)

    • Changes powershell execution policy (Bypass)

      • pet.exe (PID: 3384)

    • SNAKE has been detected (YARA)

      • pet.exe (PID: 3504)

    • Steals credentials from Web Browsers

      • pet.exe (PID: 3504)

    • Actions looks like stealing of personal data

      • pet.exe (PID: 3504)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • pet.exe (PID: 3384)

    • Process creates executable files without a name

      • Powershell.exe (PID: 3460)

    • Reads the Internet Settings

      • pet.exe (PID: 3504)

    • Application launched itself

      • pet.exe (PID: 3384)

    • Accesses Microsoft Outlook profiles

      • pet.exe (PID: 3504)

    • Checks for external IP

      • pet.exe (PID: 3504)

    • Loads DLL from Mozilla Firefox

      • pet.exe (PID: 3504)

    • Reads settings of System Certificates

      • pet.exe (PID: 3504)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • pet.exe (PID: 3504)

  • INFO

    • Reads the computer name

      • pet.exe (PID: 3384)
      • pet.exe (PID: 3504)
      • wmpnscfg.exe (PID: 3612)
      • wmpnscfg.exe (PID: 3632)

    • Checks supported languages

      • pet.exe (PID: 3384)
      • pet.exe (PID: 3504)
      • wmpnscfg.exe (PID: 3612)
      • wmpnscfg.exe (PID: 3632)

    • Reads the machine GUID from the registry

      • pet.exe (PID: 3384)
      • pet.exe (PID: 3504)
      • wmpnscfg.exe (PID: 3612)
      • wmpnscfg.exe (PID: 3632)

    • Reads Environment values

      • pet.exe (PID: 3504)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3612)
      • wmpnscfg.exe (PID: 3632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(3504) pet.exe
Keys
DES6fc98cd6
Options
SMTP Userkingjacko@yandex.com
SMTP Passwordchijiokejackson121
SMTP Hostmail.yandex.com
SMTP SendTokingjacko@yandex.com
SMTP Port587
Telegram Bot Token5206100572:AAFn3MxBuN0bjQhfY8y1ed9Iwi79LyIe75I
Telegram Chat ID2135869667
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2096:11:07 08:34:03+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 380928
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x5ee0e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: pet
FileVersion: 1.0.0.0
InternalName: pet.exe
LegalCopyright: Copyright © 2021
LegalTrademarks: -
OriginalFileName: pet.exe
ProductName: pet
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pet.exe no specs powershell.exe #SNAKE pet.exe wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3384"C:\Users\admin\Desktop\pet.exe" C:\Users\admin\Desktop\pet.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
pet
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\pet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3460"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\admin\Desktop\pet.exe' 'C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
pet.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3504C:\Users\admin\Desktop\pet.exeC:\Users\admin\Desktop\pet.exe
pet.exe
User:
admin
Integrity Level:
MEDIUM
Description:
pet
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\pet.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
SnakeKeylogger
(PID) Process(3504) pet.exe
Keys
DES6fc98cd6
Options
SMTP Userkingjacko@yandex.com
SMTP Passwordchijiokejackson121
SMTP Hostmail.yandex.com
SMTP SendTokingjacko@yandex.com
SMTP Port587
Telegram Bot Token5206100572:AAFn3MxBuN0bjQhfY8y1ed9Iwi79LyIe75I
Telegram Chat ID2135869667
3612"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3632"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
4 758
Read events
4 686
Write events
66
Delete events
6

Modification events

(PID) Process:(3460) Powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3612) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{6BBB2EDA-E663-4F8F-B608-C9AFEDEB8911}\{A4C3288F-F36B-4DBD-971B-69DB0A60E821}
Operation:delete keyName:(default)
Value:
(PID) Process:(3612) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{6BBB2EDA-E663-4F8F-B608-C9AFEDEB8911}
Operation:delete keyName:(default)
Value:
(PID) Process:(3612) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{250BA96C-01F6-47F9-BA15-A830C0915FB0}
Operation:delete keyName:(default)
Value:
(PID) Process:(3632) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{68908A7C-59B1-4CCB-9A3C-0620E3345258}\{7115A35A-93FD-47F7-92FA-5218EF9B7B7D}
Operation:delete keyName:(default)
Value:
(PID) Process:(3632) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{68908A7C-59B1-4CCB-9A3C-0620E3345258}
Operation:delete keyName:(default)
Value:
(PID) Process:(3632) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{68F34061-137E-47A2-9ED6-1A54DF457615}
Operation:delete keyName:(default)
Value:
(PID) Process:(3504) pet.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3460Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UQJXI46IEE5IFDP5N1FK.tempbinary
MD5:C681106A4168B935996B10134404F885
SHA256:89AB4ECFBB5C1FD07CF99465E36B1A08F51E2512AA60DDD616D4A37753FC112D
3460Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:C681106A4168B935996B10134404F885
SHA256:89AB4ECFBB5C1FD07CF99465E36B1A08F51E2512AA60DDD616D4A37753FC112D
3460Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exeexecutable
MD5:C6184A0858570AB06401A2D9A7ABB84C
SHA256:7ED99EB3221D685130AC3695222E9025DD62E2880F3AF360140EF1D0532E80E3
3460Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF16670b.TMPbinary
MD5:C681106A4168B935996B10134404F885
SHA256:89AB4ECFBB5C1FD07CF99465E36B1A08F51E2512AA60DDD616D4A37753FC112D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
2
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3504
pet.exe
GET
200
132.226.247.73:80
http://checkip.dyndns.org/
unknown
html
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3504
pet.exe
132.226.247.73:80
checkip.dyndns.org
ORACLE-BMC-31898
BR
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3504
pet.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown

DNS requests

Domain
IP
Reputation
checkip.dyndns.org
  • 132.226.247.73
  • 158.101.44.242
  • 193.122.130.0
  • 132.226.8.169
  • 193.122.6.168
shared
api.telegram.org
  • 149.154.167.220
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)
1080
svchost.exe
Misc activity
AV INFO Query to checkip.dyndns. Domain
3504
pet.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
3504
pet.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
1080
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
3504
pet.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
3504
pet.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pet.exe