snakekeylogger | ce1cf72e73bce44e190b5998072b7069653c9afb3fe4499441e8d4d791f56837

General

Target

ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
Size

767KB
MD5

ecac725ddcdd32bc821da7f6857dec95
SHA1

079fa74915e6fba3c13a510d2003e4119c724ac2
SHA256

ce1cf72e73bce44e190b5998072b7069653c9afb3fe4499441e8d4d791f56837
SHA512

ffa4a7994691f61571d645cefe8db66c896bdfa3b88db593ce0b6ecebad89b7c9d4245287a5a17a951429a1cf6944c3ffd36f655f2043fdbe1ddab3eba051a7f
SSDEEP

12288:TzYXTjASHq0pkzV386oGr7m5WgaBEjvCov9hFcR64V7D3NLirTXFi4t2NjFA:TzOTcI486rriZaCLCE9wR9V7D3Nun84F

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
25
Username:
[email protected]
Password:
BkKMmzZ1
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5020-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

40 checkip.dyndns.org
42 freegeoip.app
43 freegeoip.app

flow	ioc
40	checkip.dyndns.org
42	freegeoip.app
43	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

description	pid	process	target process
PID 1580 set thread context of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1900 5020 WerFault.exe ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

pid process

5020 ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 5020 ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

pid	pid_target	process	target process
1900	5020	WerFault.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

pid	process
5020	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	5020	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

description	pid	process	target process
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
PID 1580 wrote to memory of 5020	1580	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe	ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 1808
    3⤵
    - Program crash
    PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 5020
1⤵
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ecac725ddcdd32bc821da7f6857dec95_JaffaCakes118.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1580-8-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/1580-5-0x0000000005850000-0x000000000585A000-memory.dmp

Filesize
40KB

Download
memory/1580-9-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/1580-4-0x0000000005830000-0x0000000005840000-memory.dmp

Filesize
64KB

Download
memory/1580-10-0x0000000007410000-0x000000000749E000-memory.dmp

Filesize
568KB

Download
memory/1580-6-0x0000000006F90000-0x000000000702C000-memory.dmp

Filesize
624KB

Download
memory/1580-7-0x0000000006F00000-0x0000000006F1A000-memory.dmp

Filesize
104KB

Download
memory/1580-11-0x0000000009A90000-0x0000000009AB6000-memory.dmp

Filesize
152KB

Download
memory/1580-3-0x0000000005670000-0x0000000005702000-memory.dmp

Filesize
584KB

Download
memory/1580-2-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/1580-0-0x0000000000C00000-0x0000000000CC6000-memory.dmp

Filesize
792KB

Download
memory/1580-15-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/1580-1-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/5020-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/5020-16-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/5020-17-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/5020-18-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads