snakekeylogger | b0cc2b05abaf593a784bb9d83cd0a61bf5b218605f61dba802df21c8ea54c7c6

General

Target

f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
Size

582KB
MD5

f014241e8c93d4dbafb85339eae88015
SHA1

9c5599c4f75b03928576778ec87a55d56d3cefde
SHA256

b0cc2b05abaf593a784bb9d83cd0a61bf5b218605f61dba802df21c8ea54c7c6
SHA512

117e90944b92a26a019aca33c2666d6beaa6a92ec237dc487c5a037ac309eb38cb15bfa4f801795d1bbef05b99ec494945a4e86c6e21a11bbff1ebaa7c746fc2
SSDEEP

12288:0JLLLrNfcdb6I8LBqzdhRv8rjGiLnM0w+aa59oeGHcm7mo5oFCEkv:wNf0gtqZcj9/wR7mo5oFCEkv

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
miratechs.gq
Port:
587
Username:
arinzelog@miratechs.gq
Password:
7213575aceACE@#$
Email To:
arinze@miratechs.gq

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2628-10-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2628-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2628-16-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2628-19-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2628-21-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2628-23-0x00000000024E0000-0x0000000002520000-memory.dmp	family_snakekeylogger
behavioral1/memory/2628-25-0x00000000024E0000-0x0000000002520000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/2000-3-0x00000000003C0000-0x00000000003D2000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 freegeoip.app
9 freegeoip.app
4 checkip.dyndns.org

flow	ioc
8	freegeoip.app
9	freegeoip.app
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

description	pid	process	target process
PID 2000 set thread context of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2672 2628 WerFault.exe f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

pid process

2628 f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2628 f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

pid	pid_target	process	target process
2672	2628	WerFault.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

pid	process
2628	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2628	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exef014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe

description	pid	process	target process
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2000 wrote to memory of 2628	2000	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
PID 2628 wrote to memory of 2672	2628	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	WerFault.exe
PID 2628 wrote to memory of 2672	2628	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	WerFault.exe
PID 2628 wrote to memory of 2672	2628	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	WerFault.exe
PID 2628 wrote to memory of 2672	2628	f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f014241e8c93d4dbafb85339eae88015_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1580
3⤵
- Program crash
PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-0-0x0000000000CE0000-0x0000000000D78000-memory.dmp

Filesize
608KB

Download
memory/2000-1-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-2-0x0000000000A00000-0x0000000000A40000-memory.dmp

Filesize
256KB

Download
memory/2000-3-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2000-4-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-5-0x0000000000A00000-0x0000000000A40000-memory.dmp

Filesize
256KB

Download
memory/2000-6-0x00000000055E0000-0x0000000005652000-memory.dmp

Filesize
456KB

Download
memory/2000-7-0x0000000000C80000-0x0000000000CAA000-memory.dmp

Filesize
168KB

Download
memory/2000-18-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-9-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-16-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-21-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2628-22-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2628-23-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download
memory/2628-24-0x0000000074310000-0x00000000749FE000-memory.dmp

Filesize
6.9MB

Download
memory/2628-25-0x00000000024E0000-0x0000000002520000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads