Analysis

  • max time kernel
    119s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-04-2024 20:21

General

  • Target

    f4406df1b0ca5dc97b1f0d2f57102e27_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    f4406df1b0ca5dc97b1f0d2f57102e27

  • SHA1

    397851638f1cc999615aeca911a1a02a180b5d99

  • SHA256

    460ece62f40e00fbde378d890513acb09f03fb2f4a8da93b6305a0df0c5544dd

  • SHA512

    8d04d63fdc2849013f624b2a692e10e5076d8e8b6c5635d939bd096ab8d54361625cb086990a7192cc0adb0629f839467f9212dab8b86f33eeede2130657e978

  • SSDEEP

    24576:yzoIWmb+Mg2gRVyt5OgPf4Am4H+SHLw78aUOGemKDL0dlRG95WN90bc:yzovmbgRVCJP/HLUnUO8KDL0dno58ib

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.crmsynergies.xyz
  • Port:
    587
  • Username:
    info@crmsynergies.xyz
  • Password:
    qWU#FcYx(9

Signatures

  • Detect ZGRat V1 1 IoCs
  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4406df1b0ca5dc97b1f0d2f57102e27_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f4406df1b0ca5dc97b1f0d2f57102e27_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1680
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2416

Network

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\RegAsm.exe
    Filesize

    63KB

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/1528-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
    Filesize

    4KB

  • memory/1528-15-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1528-25-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1528-23-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1528-12-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1528-19-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1528-11-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/1528-13-0x0000000000400000-0x000000000046A000-memory.dmp
    Filesize

    424KB

  • memory/2896-5-0x0000000000520000-0x0000000000560000-memory.dmp
    Filesize

    256KB

  • memory/2896-1-0x0000000074390000-0x0000000074A7E000-memory.dmp
    Filesize

    6.9MB

  • memory/2896-2-0x0000000074390000-0x0000000074A7E000-memory.dmp
    Filesize

    6.9MB

  • memory/2896-0-0x00000000009F0000-0x0000000000B6A000-memory.dmp
    Filesize

    1.5MB

  • memory/2896-7-0x00000000002F0000-0x0000000000312000-memory.dmp
    Filesize

    136KB

  • memory/2896-22-0x0000000074390000-0x0000000074A7E000-memory.dmp
    Filesize

    6.9MB

  • memory/2896-4-0x0000000000520000-0x0000000000560000-memory.dmp
    Filesize

    256KB

  • memory/2896-3-0x0000000004D80000-0x0000000004EC0000-memory.dmp
    Filesize

    1.2MB