snakekeylogger | 48390eb59fdea14012e0c48d7036b77356a1ba0318c446d5b75dcc897883096b

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
Size 1.1MB
Sample240417-2s8dksgg46
SHA256 48390eb59fdea14012e0c48d7036b77356a1ba0318c446d5b75dcc897883096b
MD5 f6bf150be5bb2b8f7760cbfb5cff8516
SHA1 8e57b80e0e3d5d1283251d5cbd687f7177bdac0c
SHA512 a68694e2b6455231ab69525283b99ec4ff6a0980f603474f61c02cde3a9b7bb9e9dd3c9d35128efe6ad9d321bf72726f9b62895251caeee39c58ffe01f44241b
SSDEEP 24576:CwTM08xJoPJuaO80BunLet7jsfjTjw5w0TydSf/do3h3/AXdXKO9VpAPqv:CwTMLmJua2Bu4w7Tjyw0ldDQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol
smtp
Host
mail.fortissoftwaresolution.com
Port
587
Username
[email protected]
Password
Fortis@123
Email to
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4076-6-0x0000000000400000-0x000000000047C000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3296 set thread context of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
4076	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
Token: SeDebugPrivilege	4076	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
Token: SeRestorePrivilege	2568	dw20.exe
Token: SeBackupPrivilege	2568	dw20.exe
Token: SeBackupPrivilege	2568	dw20.exe
Token: SeBackupPrivilege	2568	dw20.exe
Token: SeBackupPrivilege	2568	dw20.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4500	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	92
PID 3296 wrote to memory of 4500	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	92
PID 3296 wrote to memory of 4500	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	92
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 3296 wrote to memory of 4076	3296	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	93
PID 4076 wrote to memory of 2568	4076	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	94
PID 4076 wrote to memory of 2568	4076	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	94
PID 4076 wrote to memory of 2568	4076	f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe"
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1488
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\f6bf150be5bb2b8f7760cbfb5cff8516_JaffaCakes118.exe.log
Size 594B
SHA256 2707fc7f074413881b7bafca05079327b188db6005709951e7f69d39a2af97c0
MD5 fdb26b3b547022b45cfaeee57eafd566
SHA1 11c6798b8a59233f404014c5e79b3363cd564b37
SHA512 44d9bb8c0f0b341690d00eda86e15a50f7f29ce9595925c1a2a7e19ad26202d10049a7a97bea278ecb7d429ad555de8edceeffff664d4b06309a9410a09bb700
MD5 SHA1 SHA512

Submit Download

memory/3296-10-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/3296-1-0x00000000010F0000-0x0000000001100000-memory.dmp

Download

memory/3296-2-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/3296-3-0x00000000010F0000-0x0000000001100000-memory.dmp

Download

memory/3296-4-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/3296-5-0x00000000010F0000-0x0000000001100000-memory.dmp

Download

memory/3296-0-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/4076-6-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/4076-11-0x0000000001230000-0x0000000001240000-memory.dmp

Download

memory/4076-9-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/4076-12-0x0000000074880000-0x0000000074E31000-memory.dmp

Download

memory/4076-19-0x0000000074880000-0x0000000074E31000-memory.dmp

Download