snakekeylogger | 406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26108db5b69562376697d90215395c87_JaffaCakes118.exe
Size

2.2MB
MD5

26108db5b69562376697d90215395c87
SHA1

ebd57ecda0c2a6cca843ead90d9c845376dfe47a
SHA256

406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843
SHA512

d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e
SSDEEP

12288:mcf8x8hkm0WhdWCOt58IWDNuuc2eXNPnrEdrE:duj8IWDNuucxXN/odo

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
restd.xyz
Port:
587
Username:
[email protected]
Password:
sd?Y&2i.6@Yt
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2080-7-0x00000000004C0000-0x00000000004E6000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	26108db5b69562376697d90215395c87_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	dfxzdg.exe

Executes dropped EXE 2 IoCs

pid	Process
3988	dfxzdg.exe
3780	dfxzdg.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	freegeoip.app
18	freegeoip.app
33	freegeoip.app
14	checkip.dyndns.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4028 set thread context of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 3988 set thread context of 3780	3988	dfxzdg.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1724	2080	WerFault.exe	89
3632	3780	WerFault.exe	106

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4816	schtasks.exe
676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2080	26108db5b69562376697d90215395c87_JaffaCakes118.exe
3780	dfxzdg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe
Token: SeDebugPrivilege	2080	26108db5b69562376697d90215395c87_JaffaCakes118.exe
Token: SeDebugPrivilege	3988	dfxzdg.exe
Token: SeDebugPrivilege	3780	dfxzdg.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	89
PID 4028 wrote to memory of 3992	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	94
PID 4028 wrote to memory of 3992	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	94
PID 4028 wrote to memory of 3992	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	94
PID 4028 wrote to memory of 4720	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	96
PID 4028 wrote to memory of 4720	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	96
PID 4028 wrote to memory of 4720	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	96
PID 3992 wrote to memory of 4816	3992	cmd.exe	98
PID 3992 wrote to memory of 4816	3992	cmd.exe	98
PID 3992 wrote to memory of 4816	3992	cmd.exe	98
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	106
PID 3988 wrote to memory of 4520	3988	dfxzdg.exe	107
PID 3988 wrote to memory of 4520	3988	dfxzdg.exe	107
PID 3988 wrote to memory of 4520	3988	dfxzdg.exe	107
PID 3988 wrote to memory of 3052	3988	dfxzdg.exe	108
PID 3988 wrote to memory of 3052	3988	dfxzdg.exe	108
PID 3988 wrote to memory of 3052	3988	dfxzdg.exe	108
PID 4520 wrote to memory of 676	4520	cmd.exe	111
PID 4520 wrote to memory of 676	4520	cmd.exe	111
PID 4520 wrote to memory of 676	4520	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1792
    3⤵
    - Program crash
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
  2⤵
  PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2080 -ip 2080
1⤵
PID:692

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
  "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1788
    3⤵
    - Program crash
    PID:3632
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
  2⤵
  PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3780 -ip 3780
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe

Filesize
2.2MB

MD5
26108db5b69562376697d90215395c87

SHA1
ebd57ecda0c2a6cca843ead90d9c845376dfe47a

SHA256
406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

SHA512
d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

Download Submit
memory/2080-9-0x0000000002540000-0x0000000002550000-memory.dmp

Filesize
64KB

Download
memory/2080-12-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-6-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-7-0x00000000004C0000-0x00000000004E6000-memory.dmp

Filesize
152KB

Download
memory/2080-8-0x0000000004B60000-0x0000000004BFC000-memory.dmp

Filesize
624KB

Download
memory/3780-24-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3780-23-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/3780-22-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3988-18-0x0000000000120000-0x0000000000358000-memory.dmp

Filesize
2.2MB

Download
memory/3988-17-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3988-19-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/3988-25-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-5-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/4028-13-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-4-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4028-16-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4028-1-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-3-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/4028-2-0x0000000005490000-0x0000000005A34000-memory.dmp

Filesize
5.6MB

Download
memory/4028-0-0x0000000000280000-0x00000000004B8000-memory.dmp

Filesize
2.2MB

Download