snakekeylogger | 7f8005263bd0f294e941bcb91055b8be6c4d55266ca6e37f5c146ca2e3362a9f

General

Target

92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
Size

321KB
MD5

92f621fe4834e0ba3bc3b0038bff3b8d
SHA1

7fec5da55e92dae36a0aa8310c5a223b2dbab9bb
SHA256

7f8005263bd0f294e941bcb91055b8be6c4d55266ca6e37f5c146ca2e3362a9f
SHA512

0b5592d019bd019e0026a6741086aa72b82238294034f649769f8f2adaa870b3da8f337331bffc61f350b76e811218b82a6c71a637227904d8fec94eced1e22d
SSDEEP

6144:Qb8ZCMkhBDmysZHCJGLIHvdOCO65oKW8x2IV0YhUqSakpOGiRx:ZfSBnsN/SdaH702IVbrSak+x

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendMessage?chat_id=1063661839

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2388-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2388-10-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2388-9-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2388-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2388-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2388-20-0x0000000004970000-0x00000000049B0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

description	pid	process	target process
PID 2648 set thread context of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2020 2388 WerFault.exe 92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

pid process

2648 92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
2388 92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

pid	pid_target	process	target process
2020	2388	WerFault.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

pid	process
2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
2388	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
Token: SeDebugPrivilege	2388	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe"
  2⤵
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 1624
    3⤵
    - Program crash
    PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2388-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2388-22-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/2388-21-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/2388-20-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/2388-19-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/2388-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2388-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2388-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2388-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2388-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2388-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2388-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2648-5-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/2648-6-0x0000000004DF0000-0x0000000004E38000-memory.dmp

Filesize
288KB

Download
memory/2648-0-0x0000000000070000-0x00000000000C6000-memory.dmp

Filesize
344KB

Download
memory/2648-18-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-4-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-3-0x0000000000300000-0x000000000030A000-memory.dmp

Filesize
40KB

Download
memory/2648-2-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/2648-1-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2648 wrote to memory of 2460	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2460	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2460	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2460	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2648 wrote to memory of 2388	2648	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe
PID 2388 wrote to memory of 2020	2388	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	WerFault.exe
PID 2388 wrote to memory of 2020	2388	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	WerFault.exe
PID 2388 wrote to memory of 2020	2388	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	WerFault.exe
PID 2388 wrote to memory of 2020	2388	92f621fe4834e0ba3bc3b0038bff3b8d_JaffaCakes118.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads