snakekeylogger | 5f1b0d6fca306c6614607fb58b497f765a482b9500c1f82c1696504460b07cd8

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe
Size

915KB
MD5

ee5e1eabbdb31b6191c744b77a1de93d
SHA1

8bccbae02b39c99584168067d7d515264d1ab9a5
SHA256

5f1b0d6fca306c6614607fb58b497f765a482b9500c1f82c1696504460b07cd8
SHA512

571fd6656ce39c4d11e6915038330da31b1c9863326e81d6df03adc02f5085db7c2544fe5e0730b41a569bbf29ecb477ae60c694c15ef9374bc1f5831ebdb7be
SSDEEP

12288:LPdsn7TdmXiJnd/fq2+FVuKM4f7yXLsCf:DKnfdRJ5q2KVmm+sc

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.sayimkalip.com
Port:
587
Username:
[email protected]
Password:
3edcvfr4**
Email To:
[email protected]

https://api.telegram.org/bot1483662500:AAGrMuxJV05-It-ke-xXVV6-R6IAtETpJb0/sendMessage?chat_id=1300181783

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3640-3-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 freegeoip.app
5 checkip.dyndns.org
16 freegeoip.app
Suspicious use of SetThreadContext 1 IoCs

Processes:

ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe

description pid process target process

PID 2248 set thread context of 3640 2248 ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe MSBuild.exe

flow	ioc
18	freegeoip.app
5	checkip.dyndns.org
16	freegeoip.app

description	pid	process	target process
PID 2248 set thread context of 3640	2248	ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe	MSBuild.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

MSBuild.exe

pid process

3640 MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe

pid process

2248 ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe

pid	process
3640	MSBuild.exe

pid	process
2248	ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

MSBuild.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	3640	MSBuild.exe
Token: SeRestorePrivilege	2624	dw20.exe
Token: SeBackupPrivilege	2624	dw20.exe
Token: SeBackupPrivilege	2624	dw20.exe
Token: SeBackupPrivilege	2624	dw20.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exeMSBuild.exe

description	pid	process	target process
PID 2248 wrote to memory of 3640	2248	ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe	MSBuild.exe
PID 2248 wrote to memory of 3640	2248	ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe	MSBuild.exe
PID 2248 wrote to memory of 3640	2248	ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe	MSBuild.exe
PID 2248 wrote to memory of 3640	2248	ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe	MSBuild.exe
PID 3640 wrote to memory of 2624	3640	MSBuild.exe	dw20.exe
PID 3640 wrote to memory of 2624	3640	MSBuild.exe	dw20.exe
PID 3640 wrote to memory of 2624	3640	MSBuild.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\ee5e1eabbdb31b6191c744b77a1de93d_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1804
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-1-0x0000000000CA0000-0x0000000000DA0000-memory.dmp

Filesize
1024KB

Download
memory/2248-2-0x0000000001110000-0x0000000001112000-memory.dmp

Filesize
8KB

Download
memory/3640-3-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3640-4-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/3640-5-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download
memory/3640-6-0x0000000000FB0000-0x0000000000FC0000-memory.dmp

Filesize
64KB

Download
memory/3640-13-0x0000000075100000-0x00000000756B1000-memory.dmp

Filesize
5.7MB

Download