snakekeylogger | ace1da8276007015547f39a609d2fb1ad3b286df841c5bb70d36934c9f32a140

General

Target

f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
Size

1.2MB
MD5

f826222ce15feefe3db0e05a0a8d3b28
SHA1

7fb72dd607a6ecb4feb6d349d2eb6247bc06d81b
SHA256

ace1da8276007015547f39a609d2fb1ad3b286df841c5bb70d36934c9f32a140
SHA512

cc9dab4b8640177b183f904c8a52748f1bf9a64ea921451cce04f2732815850c8ac3a1db4e135a50e45cd59f57d2e3db2eb690395baec2c34930fec7436c9a43
SSDEEP

24576:ORS/d3GKzks1ksfJ4wlctmWMOE3Xq05jFSXvrRG27RJy8jh8N6ZNBZ:UKBJ4rtmBpms2neN6ZNB

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.cavilum.cl
Port:
587
Username:
mmardones@cavilum.cl
Password:
Cavilum4313
Email To:
nominas@haciendacantalagua.com

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2580-12-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2580-14-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2580-18-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2580-20-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2580-22-0x0000000000400000-0x0000000000424000-memory.dmp	family_snakekeylogger
behavioral1/memory/2580-25-0x00000000043D0000-0x0000000004410000-memory.dmp	family_snakekeylogger
behavioral1/memory/2580-27-0x00000000043D0000-0x0000000004410000-memory.dmp	family_snakekeylogger

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/3000-3-0x0000000000260000-0x0000000000272000-memory.dmp	CustAttr

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org
8 freegeoip.app
9 freegeoip.app

flow	ioc
4	checkip.dyndns.org
8	freegeoip.app
9	freegeoip.app

Suspicious use of SetThreadContext 1 IoCs

Processes:

f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

description	pid	process	target process
PID 3000 set thread context of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1092 2580 WerFault.exe f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

pid process

2580 f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2580 f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

pid	pid_target	process	target process
1092	2580	WerFault.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

pid	process
2580	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2580	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exef826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe

description	pid	process	target process
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 3000 wrote to memory of 2580	3000	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
PID 2580 wrote to memory of 1092	2580	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	WerFault.exe
PID 2580 wrote to memory of 1092	2580	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	WerFault.exe
PID 2580 wrote to memory of 1092	2580	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	WerFault.exe
PID 2580 wrote to memory of 1092	2580	f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000

C:\Users\Admin\AppData\Local\Temp\f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f826222ce15feefe3db0e05a0a8d3b28_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1580
3⤵
- Program crash
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2580-22-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-12-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2580-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-27-0x00000000043D0000-0x0000000004410000-memory.dmp

Filesize
256KB

Download
memory/2580-26-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2580-25-0x00000000043D0000-0x0000000004410000-memory.dmp

Filesize
256KB

Download
memory/2580-8-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-23-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/2580-20-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3000-4-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/3000-3-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/3000-0-0x0000000000DF0000-0x0000000000F28000-memory.dmp

Filesize
1.2MB

Download
memory/3000-1-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/3000-24-0x00000000744E0000-0x0000000074BCE000-memory.dmp

Filesize
6.9MB

Download
memory/3000-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/3000-7-0x0000000000570000-0x0000000000594000-memory.dmp

Filesize
144KB

Download
memory/3000-6-0x0000000005680000-0x000000000570E000-memory.dmp

Filesize
568KB

Download
memory/3000-5-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads