snakekeylogger | 57c6ce03a179c46ceb169eae0d76ee19fe224b36db65139cf5eefa94c35e5ba3

General

Target

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
Size

711KB
MD5

543a9db368c33915bcf44b7aa00013cf
SHA1

99ef6b338b105e698f8cf0ef12a2d37f331e39d0
SHA256

57c6ce03a179c46ceb169eae0d76ee19fe224b36db65139cf5eefa94c35e5ba3
SHA512

0663b0054b284049efacdad8650c9d1be94e583e9493bcc73a09897457396249fcfc50a7a73adb1349eeeea550ca97513b51bc98eb9f18e3be1fde4c1ac71d82
SSDEEP

12288:jJ1FGs+9KgR7BnkPnoGAi8mOZY/a+bm8qrIYKQeuls9:lH+9DR7BkvoPnMa+baUYKQeKU

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1296-8-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger
behavioral1/memory/1296-10-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger
behavioral1/memory/1296-11-0x0000000000400000-0x000000000048B000-memory.dmp	family_snakekeylogger

Loads dropped DLL 1 IoCs

Processes:

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

pid process

2088 543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
6 freegeoip.app
7 freegeoip.app

pid	process
2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

flow	ioc
4	checkip.dyndns.org
6	freegeoip.app
7	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

description	pid	process	target process
PID 2088 set thread context of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

pid process

1296 543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1296 543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

pid	process
1296	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1296	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 552
    3⤵
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst230C.tmp\ukczapxqnn.dll

Filesize
106KB

MD5
5a0549e4b724e46317ac8d0ff1f0aefe

SHA1
0d05ea79d334c8c44c8375367442325072532473

SHA256
0def082d0bbe804cfa3f70e3bc79cf1d97507506481f41f0f1761fb9a90e7ac1

SHA512
10ab45a6c0e71e3544176c2165fa4189825720434ee21924ea86d077eb929e07e38ddb2506e2d4006a4c1c88cf21dca31b80f8a1ca6793a748a7b420f7784e50

Download Submit
memory/1296-16-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-17-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/1296-11-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1296-12-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/1296-13-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-14-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-10-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1296-8-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1296-15-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-24-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-20-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/1296-21-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-22-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/1296-23-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/2712-18-0x00000000024A0000-0x00000000024A1000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 2088 wrote to memory of 1296	2088	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe
PID 1296 wrote to memory of 2712	1296	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	dw20.exe
PID 1296 wrote to memory of 2712	1296	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	dw20.exe
PID 1296 wrote to memory of 2712	1296	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	dw20.exe
PID 1296 wrote to memory of 2712	1296	543a9db368c33915bcf44b7aa00013cf_JaffaCakes118.exe	dw20.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads