snakekeylogger | 499619c6bc43585013dd421ef88cf14830c85a28bc3ce3984bcf62a24f6d59fc

General

Target

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
Size

489KB
MD5

ad76b9dfa5917952e3168986e670f683
SHA1

ddc0497585e60aa3bb95453be1ac1e82425d9b38
SHA256

499619c6bc43585013dd421ef88cf14830c85a28bc3ce3984bcf62a24f6d59fc
SHA512

a95f9e024c6c0ff7f969ad4bde9d6fd6b6861141d94ca3aee242c6dca35b7591545e49bcfed93e691293cdb4db1553b7a096865c10bdbdf3891844c5c816dca4
SSDEEP

6144:88LxBVFEg4x6f+WmGOYJ12CKRP+IWZRL0gZCPPnTr1TSvKsa5bcwJ:JFEg4xB+Id+/7LwnT7Xbc+

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-9-0x0000000000400000-0x000000000044B000-memory.dmp	family_snakekeylogger
behavioral1/memory/2868-12-0x0000000000400000-0x000000000044B000-memory.dmp	family_snakekeylogger
behavioral1/memory/2868-13-0x0000000000400000-0x000000000044B000-memory.dmp	family_snakekeylogger
behavioral1/memory/2868-14-0x0000000000580000-0x00000000005A4000-memory.dmp	family_snakekeylogger
behavioral1/memory/2868-16-0x0000000004600000-0x0000000004640000-memory.dmp	family_snakekeylogger

Loads dropped DLL 1 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid process

2756 ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app

pid	process
2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

description	pid	process	target process
PID 2756 set thread context of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2572 2868 WerFault.exe ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid process

2868 ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2868 ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid	pid_target	process	target process
2572	2868	WerFault.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

pid	process
2868	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2868	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exead76b9dfa5917952e3168986e670f683_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 1532
    3⤵
    - Program crash
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso9A0F.tmp\fwvyvpj.dll

Filesize
30KB

MD5
7f78792ff322a3cf595eb8e9417ec39c

SHA1
93332d47608cc064ffdb1576c67cf609f4969476

SHA256
92b284f16e60425b34f717ce20e9a379eee29163d2d47d35845110e171cefef7

SHA512
c6353e3e3124f46f2132b45a08a9711806d8f2275848e600d9d8ba1a1eac0f74120a3d51260dede3e6a52d51533f82aa7e88ba199edeceeb456c174290e255b2

Download Submit
memory/2756-7-0x0000000074BD0000-0x0000000074BDC000-memory.dmp

Filesize
48KB

Download
memory/2756-11-0x0000000074BD0000-0x0000000074BDC000-memory.dmp

Filesize
48KB

Download
memory/2868-9-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2868-12-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2868-13-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2868-14-0x0000000000580000-0x00000000005A4000-memory.dmp

Filesize
144KB

Download
memory/2868-15-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-16-0x0000000004600000-0x0000000004640000-memory.dmp

Filesize
256KB

Download
memory/2868-17-0x0000000004600000-0x0000000004640000-memory.dmp

Filesize
256KB

Download
memory/2868-19-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2756 wrote to memory of 2868	2756	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe
PID 2868 wrote to memory of 2572	2868	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	WerFault.exe
PID 2868 wrote to memory of 2572	2868	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	WerFault.exe
PID 2868 wrote to memory of 2572	2868	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	WerFault.exe
PID 2868 wrote to memory of 2572	2868	ad76b9dfa5917952e3168986e670f683_JaffaCakes118.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads