snakekeylogger | 406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

General

Target

26108db5b69562376697d90215395c87_JaffaCakes118.exe
Size

2.2MB
MD5

26108db5b69562376697d90215395c87
SHA1

ebd57ecda0c2a6cca843ead90d9c845376dfe47a
SHA256

406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843
SHA512

d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e
SSDEEP

12288:mcf8x8hkm0WhdWCOt58IWDNuuc2eXNPnrEdrE:duj8IWDNuucxXN/odo

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
restd.xyz
Port:
587
Username:
[email protected]
Password:
sd?Y&2i.6@Yt
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2080-7-0x00000000004C0000-0x00000000004E6000-memory.dmp	family_snakekeylogger

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

26108db5b69562376697d90215395c87_JaffaCakes118.exedfxzdg.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	26108db5b69562376697d90215395c87_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	dfxzdg.exe

Executes dropped EXE 2 IoCs

Processes:

dfxzdg.exedfxzdg.exe

pid process

3988 dfxzdg.exe
3780 dfxzdg.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 freegeoip.app
18 freegeoip.app
33 freegeoip.app
14 checkip.dyndns.org

pid	process
3988	dfxzdg.exe
3780	dfxzdg.exe

flow	ioc
17	freegeoip.app
18	freegeoip.app
33	freegeoip.app
14	checkip.dyndns.org

Suspicious use of SetThreadContext 2 IoCs

Processes:

26108db5b69562376697d90215395c87_JaffaCakes118.exedfxzdg.exe

description	pid	process	target process
PID 4028 set thread context of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 3988 set thread context of 3780	3988	dfxzdg.exe	dfxzdg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1724 2080 WerFault.exe 26108db5b69562376697d90215395c87_JaffaCakes118.exe
3632 3780 WerFault.exe dfxzdg.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4816 schtasks.exe
676 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

26108db5b69562376697d90215395c87_JaffaCakes118.exedfxzdg.exe

pid process

2080 26108db5b69562376697d90215395c87_JaffaCakes118.exe
3780 dfxzdg.exe

pid	pid_target	process	target process
1724	2080	WerFault.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
3632	3780	WerFault.exe	dfxzdg.exe

pid	process
4816	schtasks.exe
676	schtasks.exe

pid	process
2080	26108db5b69562376697d90215395c87_JaffaCakes118.exe
3780	dfxzdg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

26108db5b69562376697d90215395c87_JaffaCakes118.exe26108db5b69562376697d90215395c87_JaffaCakes118.exedfxzdg.exedfxzdg.exe

description	pid	process
Token: SeDebugPrivilege	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe
Token: SeDebugPrivilege	2080	26108db5b69562376697d90215395c87_JaffaCakes118.exe
Token: SeDebugPrivilege	3988	dfxzdg.exe
Token: SeDebugPrivilege	3780	dfxzdg.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

26108db5b69562376697d90215395c87_JaffaCakes118.execmd.exedfxzdg.execmd.exe

description	pid	process	target process
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 2080	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	26108db5b69562376697d90215395c87_JaffaCakes118.exe
PID 4028 wrote to memory of 3992	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	cmd.exe
PID 4028 wrote to memory of 3992	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	cmd.exe
PID 4028 wrote to memory of 3992	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	cmd.exe
PID 4028 wrote to memory of 4720	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	cmd.exe
PID 4028 wrote to memory of 4720	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	cmd.exe
PID 4028 wrote to memory of 4720	4028	26108db5b69562376697d90215395c87_JaffaCakes118.exe	cmd.exe
PID 3992 wrote to memory of 4816	3992	cmd.exe	schtasks.exe
PID 3992 wrote to memory of 4816	3992	cmd.exe	schtasks.exe
PID 3992 wrote to memory of 4816	3992	cmd.exe	schtasks.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 3780	3988	dfxzdg.exe	dfxzdg.exe
PID 3988 wrote to memory of 4520	3988	dfxzdg.exe	cmd.exe
PID 3988 wrote to memory of 4520	3988	dfxzdg.exe	cmd.exe
PID 3988 wrote to memory of 4520	3988	dfxzdg.exe	cmd.exe
PID 3988 wrote to memory of 3052	3988	dfxzdg.exe	cmd.exe
PID 3988 wrote to memory of 3052	3988	dfxzdg.exe	cmd.exe
PID 3988 wrote to memory of 3052	3988	dfxzdg.exe	cmd.exe
PID 4520 wrote to memory of 676	4520	cmd.exe	schtasks.exe
PID 4520 wrote to memory of 676	4520	cmd.exe	schtasks.exe
PID 4520 wrote to memory of 676	4520	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028

C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 1792
3⤵
- Program crash
PID:1724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
3⤵
- Creates scheduled task(s)
PID:4816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\26108db5b69562376697d90215395c87_JaffaCakes118.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
2⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2080 -ip 2080
1⤵
PID:692

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3988

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
"C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1788
3⤵
- Program crash
PID:3632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe'" /f
3⤵
- Creates scheduled task(s)
PID:676

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe" "C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe"
2⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3780 -ip 3780
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dfxzdg\dfxzdg.exe
Filesize
2.2MB

MD5
26108db5b69562376697d90215395c87

SHA1
ebd57ecda0c2a6cca843ead90d9c845376dfe47a

SHA256
406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

SHA512
d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

Download Submit
memory/2080-9-0x0000000002540000-0x0000000002550000-memory.dmp

Filesize
64KB

Download
memory/2080-12-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-6-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-7-0x00000000004C0000-0x00000000004E6000-memory.dmp

Filesize
152KB

Download
memory/2080-8-0x0000000004B60000-0x0000000004BFC000-memory.dmp

Filesize
624KB

Download
memory/3780-24-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3780-23-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/3780-22-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3988-18-0x0000000000120000-0x0000000000358000-memory.dmp

Filesize
2.2MB

Download
memory/3988-17-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/3988-19-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/3988-25-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-5-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/4028-13-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-4-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4028-16-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4028-1-0x0000000074C30000-0x00000000753E0000-memory.dmp

Filesize
7.7MB

Download
memory/4028-3-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/4028-2-0x0000000005490000-0x0000000005A34000-memory.dmp

Filesize
5.6MB

Download
memory/4028-0-0x0000000000280000-0x00000000004B8000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads