snakekeylogger | 20538d7772510a1a23b69ffcf5cab90f330bd665fc68fba30da4334dc0af0c19

General

Target

ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
Size

31.0MB
MD5

ecb966cd32eba8383ce4b67aa13eb2bd
SHA1

f914d42a20b819198e9e6aebd50dcfe37be8f8eb
SHA256

20538d7772510a1a23b69ffcf5cab90f330bd665fc68fba30da4334dc0af0c19
SHA512

3b004be82d662d69528751cebeef4caa1355fa56e39eb3def486e31e5c2ef7f09b174252d26f49de0c0e353c6dc4778487ec959bb061a127621ef6424aea8567
SSDEEP

12288:xpcsGI/cb3iVafvMU4lyc9YFjLChqznWB9hIl5jexZ6rjwX5x12EObba:xKyVIUD9pBolg6KH1

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
fintanA1
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2100-15-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2100-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2100-19-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2100-21-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2100-24-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2100-26-0x0000000004860000-0x00000000048A0000-memory.dmp	family_snakekeylogger
behavioral1/memory/2100-28-0x0000000004860000-0x00000000048A0000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

description	pid	process	target process
PID 2156 set thread context of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

356 2100 WerFault.exe ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2452 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exeecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

pid process

2156 ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
2100 ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

pid	pid_target	process	target process
356	2100	WerFault.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

pid	process
2452	schtasks.exe

pid	process
2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
2100	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exeecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
Token: SeDebugPrivilege	2100	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exeecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe

description	pid	process	target process
PID 2156 wrote to memory of 2452	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	schtasks.exe
PID 2156 wrote to memory of 2452	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	schtasks.exe
PID 2156 wrote to memory of 2452	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	schtasks.exe
PID 2156 wrote to memory of 2452	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	schtasks.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2156 wrote to memory of 2100	2156	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
PID 2100 wrote to memory of 356	2100	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	WerFault.exe
PID 2100 wrote to memory of 356	2100	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	WerFault.exe
PID 2100 wrote to memory of 356	2100	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	WerFault.exe
PID 2100 wrote to memory of 356	2100	ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bSSEnuseRTF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE495.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2452
- C:\Users\Admin\AppData\Local\Temp\ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ecb966cd32eba8383ce4b67aa13eb2bd_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 700
    3⤵
    - Program crash
    PID:356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE495.tmp

Filesize
1KB

MD5
735b00d77f6fcdf79e03b5535bfc7715

SHA1
ea53590ec933ea691a8520116b7436d19d4a7ca8

SHA256
2aa2b6a0c75873e33e5df5992774535f7c3199430e510fa997d7467541ee95e4

SHA512
beaaa0a576c399f68fd6b1ee8d4493457b3f657ed59cba8414a9d8dea4d0c1a23c7454af72fe5fcbb2f1a18a9013e5502441fbeae3611faf5789db656bc8fab4

Download Submit
memory/2100-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-27-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-26-0x0000000004860000-0x00000000048A0000-memory.dmp

Filesize
256KB

Download
memory/2100-25-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-24-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2100-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-28-0x0000000004860000-0x00000000048A0000-memory.dmp

Filesize
256KB

Download
memory/2100-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-15-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2100-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2156-5-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2156-7-0x0000000000700000-0x000000000072C000-memory.dmp

Filesize
176KB

Download
memory/2156-23-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-6-0x0000000005180000-0x0000000005218000-memory.dmp

Filesize
608KB

Download
memory/2156-0-0x00000000002A0000-0x000000000037C000-memory.dmp

Filesize
880KB

Download
memory/2156-4-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-3-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download
memory/2156-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2156-1-0x00000000743E0000-0x0000000074ACE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads