snakekeylogger | 665036f55a5222fab9b1d65f0cd2ba2363a1490db114c5a9bf2e0f230f1d0f7f

Analysis

max time kernel
117s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe
Size

973KB
MD5

ee88c9b476f721af2571cf310dd98a59
SHA1

2ed6cd70e7049e2eb1c8b8ecd0af4e96639fe8e0
SHA256

665036f55a5222fab9b1d65f0cd2ba2363a1490db114c5a9bf2e0f230f1d0f7f
SHA512

d0c6b5dea0fbcf7571c4513f427977981417b2a8a6108117ba0f7b23e607ab04f8546190edd5e6c4abe1f452e260f36dc8ceac4c508c8b021f43f76462894989
SSDEEP

24576:zhFfgQH5u5/d36K64JCaaUWHDD0PWNwo:zhFj/K64Jpojl2o

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.fireacoustics.com
Port:
587
Username:
[email protected]
Password:
_d:rzD~62Jxh
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/732-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/2556-8-0x00000000023D0000-0x00000000023E2000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 freegeoip.app
46 freegeoip.app
40 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe

description pid process target process

PID 2556 set thread context of 732 2556 ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe MSBuild.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2124 732 WerFault.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

732 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 732 MSBuild.exe

flow	ioc
45	freegeoip.app
46	freegeoip.app
40	checkip.dyndns.org

description	pid	process	target process
PID 2556 set thread context of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe

pid	pid_target	process	target process
2124	732	WerFault.exe	MSBuild.exe

pid	process
732	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	732	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe

description	pid	process	target process
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe
PID 2556 wrote to memory of 732	2556	ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee88c9b476f721af2571cf310dd98a59_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 732 -s 1740
3⤵
- Program crash
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 732 -ip 732
1⤵
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/732-18-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/732-17-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/732-16-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/2556-8-0x00000000023D0000-0x00000000023E2000-memory.dmp

Filesize
72KB

Download
memory/2556-11-0x0000000006700000-0x0000000006766000-memory.dmp

Filesize
408KB

Download
memory/2556-6-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

Filesize
40KB

Download
memory/2556-7-0x0000000004E00000-0x0000000004E56000-memory.dmp

Filesize
344KB

Download
memory/2556-0-0x0000000000080000-0x000000000017A000-memory.dmp

Filesize
1000KB

Download
memory/2556-9-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/2556-10-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/2556-5-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/2556-12-0x00000000067A0000-0x00000000067C6000-memory.dmp

Filesize
152KB

Download
memory/2556-4-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/2556-15-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/2556-3-0x0000000005120000-0x00000000056C4000-memory.dmp

Filesize
5.6MB

Download
memory/2556-2-0x0000000004AB0000-0x0000000004B4C000-memory.dmp

Filesize
624KB

Download
memory/2556-1-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download