Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
24/06/2024, 16:09
General
- Target 0980b6fcca0018e0aa84f9b7a2c23ee7_JaffaCakes118.exe
- Size 707KB
- Sample240624-tls2bathmm
- SHA256 93789f73943029eb9f31a99014bd2bc3d0453394d16f94a09f7cc4caf0966e94
Malware Config
Extracted
-
snakekeylogger
-
Protocol
smtp
-
Host
mail.faks-allied-health.com
-
Port
587
-
Username
-
Password
$Faks1234
-
Email to
Signatures
- Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
- Snake Keylogger payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0980b6fcca0018e0aa84f9b7a2c23ee7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0980b6fcca0018e0aa84f9b7a2c23ee7_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0980b6fcca0018e0aa84f9b7a2c23ee7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0980b6fcca0018e0aa84f9b7a2c23ee7_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 14403⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4840 -ip 48401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
0980b6fcca0018e0aa84f9b7a2c23ee7_JaffaCakes118.exe.log
memory/2116-8-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/2116-10-0x00000000072F0000-0x0000000007348000-memory.dmp
memory/2116-3-0x00000000056D0000-0x0000000005762000-memory.dmp
memory/2116-4-0x0000000005790000-0x000000000579A000-memory.dmp
memory/2116-5-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/2116-6-0x00000000057C0000-0x00000000057E2000-memory.dmp
memory/2116-7-0x000000007478E000-0x000000007478F000-memory.dmp
memory/2116-0-0x000000007478E000-0x000000007478F000-memory.dmp
memory/2116-2-0x0000000005DC0000-0x0000000006364000-memory.dmp
memory/2116-11-0x0000000007350000-0x0000000007380000-memory.dmp
memory/2116-9-0x00000000071C0000-0x000000000725C000-memory.dmp
memory/2116-16-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/2116-1-0x0000000000DC0000-0x0000000000E78000-memory.dmp
memory/4840-15-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/4840-12-0x0000000000400000-0x0000000000426000-memory.dmp
memory/4840-17-0x0000000074780000-0x0000000074F30000-memory.dmp
memory/4840-18-0x0000000074780000-0x0000000074F30000-memory.dmp