snakekeylogger | f63fb5cc22477bc30c62b92c018ad764392d5abefd9e389bba8ca9b85f5b1421

General

Target

eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
Size

671KB
MD5

eb11c51144aae060436f75639b38d347
SHA1

9b4fd38d56daf2b8863455f4b0c0ca7307ab1d37
SHA256

f63fb5cc22477bc30c62b92c018ad764392d5abefd9e389bba8ca9b85f5b1421
SHA512

eb49566036a331c0af6b1330e1937cf092c4e9a92932a733deb2bdc82b28dab8159ad34459dd2353ea6d40e3e29ddabf667af76250a024b28a947e183901cb82
SSDEEP

12288:q2TRBBPukNcEWECUxmnL4WITNxCcNRPvB6adUohAOStE+25:q2TDhpBeoL

Score

10^/10

snakekeylogger zgrat keylogger rat stealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot1914131597:AAEk7ho3IOyTPLqmScPeq-lvJXMNmllhMUw/sendMessage?chat_id=1482312326

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4632-9-0x0000000005A10000-0x0000000005A26000-memory.dmp	family_zgrat_v1

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/220-10-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral2/memory/220-15-0x0000000005700000-0x0000000005710000-memory.dmp	family_snakekeylogger

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

description	pid	process	target process
PID 4632 set thread context of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3320 220 WerFault.exe eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

pid process

220 eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 220 eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

pid	pid_target	process	target process
3320	220	WerFault.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

pid	process
220	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	220	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

description	pid	process	target process
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
PID 4632 wrote to memory of 220	4632	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe	eb11c51144aae060436f75639b38d347_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb11c51144aae060436f75639b38d347_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632

C:\Users\Admin\AppData\Local\Temp\eb11c51144aae060436f75639b38d347_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb11c51144aae060436f75639b38d347_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1476
3⤵
- Program crash
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220
1⤵
PID:2800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eb11c51144aae060436f75639b38d347_JaffaCakes118.exe.log
Filesize
886B

MD5
1c6a42caa28046767e9ec070f44d3627

SHA1
e5093f48c745c0f8137fd80d228f4c0ad6ed7a49

SHA256
f68f729688a152f3c31520313274d06d69c33b72633927a53feb9594a0fb4352

SHA512
7afc61a4a5b50d0fa11393e91504207802b6b80994da236427c89cd6912f187d7b6059e7d88cfdafa5b7dad704ba582958abbb7f20e104c842f1f75dbf73b1a1

Download Submit
memory/220-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/220-16-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/220-15-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/220-14-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4632-8-0x0000000005AE0000-0x0000000005B20000-memory.dmp

Filesize
256KB

Download
memory/4632-6-0x0000000005CA0000-0x0000000005CB0000-memory.dmp

Filesize
64KB

Download
memory/4632-7-0x00000000059C0000-0x00000000059DE000-memory.dmp

Filesize
120KB

Download
memory/4632-1-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4632-9-0x0000000005A10000-0x0000000005A26000-memory.dmp

Filesize
88KB

Download
memory/4632-5-0x0000000005B60000-0x0000000005BFC000-memory.dmp

Filesize
624KB

Download
memory/4632-4-0x0000000005A20000-0x0000000005AB2000-memory.dmp

Filesize
584KB

Download
memory/4632-13-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4632-3-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/4632-2-0x00000000058D0000-0x0000000005946000-memory.dmp

Filesize
472KB

Download
memory/4632-0-0x0000000000F10000-0x0000000000FBE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads