snakekeylogger | d43d9ff45f1d4ed26b5722c3c61c9d09d39ba76e9ce1c322867d65d05b86f3db

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
Size

301KB
MD5

efe46e1ba7f2f375e0fa71598b1cce4b
SHA1

eba5c96d60f8bf245568ebc743ac4e10f6839576
SHA256

d43d9ff45f1d4ed26b5722c3c61c9d09d39ba76e9ce1c322867d65d05b86f3db
SHA512

b625b897f2803313ac30a1d996dd9bb72d6ce3be876085099178a7ebe9f398158d7727a1ca01338b68dcc856e3b87d0b37260d70f31707c9a5e4d5af4101afed
SSDEEP

6144:+yaUM/MkhBC0NcyCD9K3fE0mNaGoJRBUJ6PQUXR5drIllAazio:+7aSBTa/D9asTxoJRBUJ6PBlrIlyazi

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
smtp.vivaldi.net
Port:
587
Username:
[email protected]
Password:
1Endurance1234
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2480-11-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2480-13-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2480-17-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2480-19-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger

Suspicious use of SetThreadContext 1 IoCs

Processes:

efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe

description	pid	process	target process
PID 2512 set thread context of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe

description	pid	process	target process
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
PID 2512 wrote to memory of 2480	2512	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe	efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2512

C:\Users\Admin\AppData\Local\Temp\efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efe46e1ba7f2f375e0fa71598b1cce4b_JaffaCakes118.exe"
2⤵
PID:2480

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-7-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-17-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2480-13-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2480-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2512-3-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/2512-6-0x0000000002040000-0x0000000002088000-memory.dmp

Filesize
288KB

Download
memory/2512-5-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2512-4-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-1-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-2-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2512-0-0x0000000000960000-0x00000000009B2000-memory.dmp

Filesize
328KB

Download
memory/2512-21-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads