snakekeylogger | 1f990c973ea05f2f378b060bcaa6a722c76533317b5700215684ea89f4307a11

General

Target

e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
Size

294KB
MD5

e0b1534a2fbb5d7ec924f2b3ca0d2941
SHA1

51790a288b7454c989c06ced70bf48189ef0fb20
SHA256

1f990c973ea05f2f378b060bcaa6a722c76533317b5700215684ea89f4307a11
SHA512

98d5454b5ff36c3d8295175b6a4809edc63d0f41bc41e83a012f844d8f9f63bb3e19d8076f29d403dca48afb5909f0b2ee6ecbd74fb2cbfbc04976240b992da7
SSDEEP

6144:khqSB9ekI/2nJK90HVB1sLmrOkHcI5xEau31hAN9awMkhB:MqS6qJKa1BuLicSxEas1h3LSB

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.medidentalssb.com
Port:
587
Username:
[email protected]
Password:
Admin1423
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2328-7-0x00000000007B0000-0x00000000007D6000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-11-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-12-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-15-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-17-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-19-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-22-0x0000000004AD0000-0x0000000004B10000-memory.dmp	family_snakekeylogger
behavioral1/memory/2484-24-0x0000000004AD0000-0x0000000004B10000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 checkip.dyndns.org
4 freegeoip.app
5 freegeoip.app
9 freegeoip.app

flow	ioc
2	checkip.dyndns.org
4	freegeoip.app
5	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

description	pid	process	target process
PID 2328 set thread context of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2768 2484 WerFault.exe e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exee0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

pid process

2328 e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
2484 e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

pid	pid_target	process	target process
2768	2484	WerFault.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

pid	process
2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
2484	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exee0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
Token: SeDebugPrivilege	2484	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exee0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe

description	pid	process	target process
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2328 wrote to memory of 2484	2328	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
PID 2484 wrote to memory of 2768	2484	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	WerFault.exe
PID 2484 wrote to memory of 2768	2484	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	WerFault.exe
PID 2484 wrote to memory of 2768	2484	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	WerFault.exe
PID 2484 wrote to memory of 2768	2484	e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e0b1534a2fbb5d7ec924f2b3ca0d2941_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1528
    3⤵
    - Program crash
    PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-0-0x0000000000130000-0x0000000000180000-memory.dmp

Filesize
320KB

Download
memory/2328-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2328-2-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download
memory/2328-3-0x0000000000590000-0x000000000059A000-memory.dmp

Filesize
40KB

Download
memory/2328-4-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2328-5-0x0000000000770000-0x00000000007B0000-memory.dmp

Filesize
256KB

Download
memory/2328-6-0x0000000005020000-0x000000000506A000-memory.dmp

Filesize
296KB

Download
memory/2328-7-0x00000000007B0000-0x00000000007D6000-memory.dmp

Filesize
152KB

Download
memory/2328-20-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-15-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-17-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-19-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-21-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2484-22-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/2484-23-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2484-24-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads