snakekeylogger | 3d6722b9d2cc8214cb14a6901f08821594e4da646eefc822e9015a7c8056fe91

General

Target

402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
Size

420KB
MD5

402d79de727a45d2a6977aeccddc5ea5
SHA1

ae4f9ba1f308443e2f96d983d62cff66124efefd
SHA256

3d6722b9d2cc8214cb14a6901f08821594e4da646eefc822e9015a7c8056fe91
SHA512

fdb9483d58bce2671a80507bcd3919cf76704ba6871661432e7e92dfd5b374c5d0225c14275eba539276b61cfc086f234e26b77df5ae2127ed1b2add206d64ec
SSDEEP

12288:z6A/Q6KbxBgxBi36bXQPiTbdrdR6DCpCr:z6sQ62426

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
cmail2.webkontrol.doruk.net.tr
Port:
587
Username:
[email protected]
Password:
mentor2014
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3536-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

38 checkip.dyndns.org
40 freegeoip.app
41 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe

description pid process target process

PID 2760 set thread context of 3536 2760 402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2448 3536 WerFault.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exeRegSvcs.exe

pid process

2760 402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
2760 402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
3536 RegSvcs.exe
3536 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2760 402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
Token: SeDebugPrivilege 3536 RegSvcs.exe

flow	ioc
38	checkip.dyndns.org
40	freegeoip.app
41	freegeoip.app

description	pid	process	target process
PID 2760 set thread context of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe

pid	pid_target	process	target process
2448	3536	WerFault.exe	RegSvcs.exe

pid	process
2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
3536	RegSvcs.exe
3536	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
Token: SeDebugPrivilege	3536	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe

description	pid	process	target process
PID 2760 wrote to memory of 2972	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 2972	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 2972	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe
PID 2760 wrote to memory of 3536	2760	402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\402d79de727a45d2a6977aeccddc5ea5_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:2972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 1788
3⤵
- Program crash
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3536 -ip 3536
1⤵
PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-8-0x0000000004EB0000-0x0000000004EC4000-memory.dmp

Filesize
80KB

Download
memory/2760-2-0x0000000004C10000-0x0000000004C68000-memory.dmp

Filesize
352KB

Download
memory/2760-9-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2760-10-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/2760-4-0x0000000004EF0000-0x0000000004F82000-memory.dmp

Filesize
584KB

Download
memory/2760-5-0x0000000004F90000-0x000000000502C000-memory.dmp

Filesize
624KB

Download
memory/2760-6-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/2760-7-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

Filesize
40KB

Download
memory/2760-0-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/2760-1-0x0000000000280000-0x00000000002F0000-memory.dmp

Filesize
448KB

Download
memory/2760-3-0x0000000009780000-0x0000000009D24000-memory.dmp

Filesize
5.6MB

Download
memory/2760-11-0x00000000071A0000-0x0000000007212000-memory.dmp

Filesize
456KB

Download
memory/2760-12-0x0000000009210000-0x0000000009236000-memory.dmp

Filesize
152KB

Download
memory/2760-16-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/3536-15-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/3536-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3536-17-0x00000000054E0000-0x00000000054F0000-memory.dmp

Filesize
64KB

Download
memory/3536-18-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads