snakekeylogger | 0497fc206987e992f615638411ea9da0470e2dcbcd05546d4240ef09a82f925f

General

Target

f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
Size

994KB
MD5

f5f6f3f20d2279fbcfe3459c2f506996
SHA1

af053d5263eaf3260eabb37822361c1017a18306
SHA256

0497fc206987e992f615638411ea9da0470e2dcbcd05546d4240ef09a82f925f
SHA512

a88fae8375449bf448148098b95d98df598cc0985ee9c6bfb6ab585d1e85c7d91cffbd1c8c6504832da8b82042726d6c3a9d7a3a1bc09b96618bd0e810fdb23c
SSDEEP

24576:STbtwEMGXU0oS1uhX+mOPEXPbc2b95QOz3:SHpMuTut7TXb95H3

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
Blessings16
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4228-5-0x0000000000400000-0x0000000000448000-memory.dmp	family_snakekeylogger

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

45 checkip.dyndns.org
47 freegeoip.app
48 freegeoip.app

flow	ioc
45	checkip.dyndns.org
47	freegeoip.app
48	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe

description	pid	process	target process
PID 4672 set thread context of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

Processes:

dw20.exe

description ioc process

File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe

description	ioc	process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exef5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe

pid	process
4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
4228	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exef5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
Token: SeDebugPrivilege	4228	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
Token: SeRestorePrivilege	976	dw20.exe
Token: SeBackupPrivilege	976	dw20.exe
Token: SeBackupPrivilege	976	dw20.exe
Token: SeBackupPrivilege	976	dw20.exe
Token: SeBackupPrivilege	976	dw20.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exef5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe

description	pid	process	target process
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4672 wrote to memory of 4228	4672	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
PID 4228 wrote to memory of 976	4228	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	dw20.exe
PID 4228 wrote to memory of 976	4228	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	dw20.exe
PID 4228 wrote to memory of 976	4228	f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1772
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\f5f6f3f20d2279fbcfe3459c2f506996_JaffaCakes118.exe.log

Filesize
496B

MD5
7baa6583f69f63f7230df9bf98448356

SHA1
fe9eb85b57192362da704a3c130377fe83862320

SHA256
a632504621b4cac1d5ba5465c7ad9b30f3d036e9838682506782124a211bed4f

SHA512
0e72541791281c0fdac1f5fc6beea0b9eb8766b2a386aecb92cb8a44e5b59b7114c79194393ddeff957ffe86021a311caed7ce2731b863d97ad441870efbc051

Download Submit
memory/4228-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4228-10-0x0000000001640000-0x0000000001650000-memory.dmp

Filesize
64KB

Download
memory/4228-8-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4228-11-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4228-18-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4672-0-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4672-1-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4672-2-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/4672-3-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download
memory/4672-4-0x00000000010B0000-0x00000000010C0000-memory.dmp

Filesize
64KB

Download
memory/4672-9-0x00000000754B0000-0x0000000075A61000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads