snakekeylogger | 7fc84151175c22d691f980a4e97131487d292e5d32e3ddf243e06065ef8ab805

General

Target

9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
Size

310KB
MD5

9f78e05450597bf6492983152fb0775b
SHA1

146781a936737cf7f9d7ac5022cf7385b7f165a3
SHA256

7fc84151175c22d691f980a4e97131487d292e5d32e3ddf243e06065ef8ab805
SHA512

44cb53ac7be417e745b886dbfd0b0e3957c213ea9f32351d22e13925d21725b8098389f61f3268ba0a8c0ef53c2f10ee2ec50f97a24a1e4b5b157a83c7ac3988
SSDEEP

6144:0vebNyM+jWfmVKeCFFHMR8A9vnY28hKITCh1GWVcY:0veROyf3eCbpA9vYbIhcQp

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.enche.com
Port:
587
Username:
[email protected]
Password:
Merchandise08012021
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4588-13-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral2/memory/4588-18-0x00000000055F0000-0x0000000005600000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 freegeoip.app
37 freegeoip.app
34 checkip.dyndns.org

flow	ioc
36	freegeoip.app
37	freegeoip.app
34	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

description	pid	process	target process
PID 3952 set thread context of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4112 4588 WerFault.exe 9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

pid process

4588 9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4588 9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

pid process

3952 9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
3952 9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

pid	pid_target	process	target process
4112	4588	WerFault.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

pid	process
4588	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4588	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

pid	process
3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

description	pid	process	target process
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
PID 3952 wrote to memory of 4588	3952	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe	9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1824
    3⤵
    - Program crash
    PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4588 -ip 4588
1⤵
PID:3360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9f78e05450597bf6492983152fb0775b_JaffaCakes118.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/3952-8-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3952-3-0x0000000005530000-0x00000000055C2000-memory.dmp

Filesize
584KB

Download
memory/3952-10-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/3952-11-0x0000000006730000-0x00000000067CC000-memory.dmp

Filesize
624KB

Download
memory/3952-5-0x00000000054F0000-0x00000000054FA000-memory.dmp

Filesize
40KB

Download
memory/3952-6-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/3952-7-0x0000000008940000-0x000000000894E000-memory.dmp

Filesize
56KB

Download
memory/3952-0-0x0000000000AD0000-0x0000000000B24000-memory.dmp

Filesize
336KB

Download
memory/3952-9-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/3952-2-0x0000000005AE0000-0x0000000006084000-memory.dmp

Filesize
5.6MB

Download
memory/3952-4-0x00000000054D0000-0x00000000054E0000-memory.dmp

Filesize
64KB

Download
memory/3952-12-0x00000000067D0000-0x000000000681A000-memory.dmp

Filesize
296KB

Download
memory/3952-17-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/3952-1-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4588-16-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4588-13-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4588-18-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/4588-19-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads